Arrested for Planting Spyware on College Compus

AndrewM1 writes "In what may serve as a cautionary tale for people who use computers in public areas, Douglas Boudreau allegedly installed keystroke-monitoring software on more than 100 computers at Boston College and then watched as thousands of people sent e-mail, downloaded files and banked online. He then stole $2000 with the information he gleamed."

Comments

But...

[Anonymous Coward]

Information wants to be free! I don't see that he did anything wrong. GNU forever!

MIT

[cristofer8]

Which is exactly why you shouldn't use single user windows systems. MIT has athena, a huge unix-based system. There's no way (barring finding the root password) for me to do this to any user other than myself.

Re:MIT

[Anonymous Coward]

Which is exactly why you shouldn't use single user windows systems. MIT has athena, a huge unix-based system. There's no way (barring finding the root password) for me to do this to any user other than myself.

Or exploiting a compromise. Granted at MIT they are more likely to catch you than at other places, but don't think that passwords make you immune to buffer overflow and other attacks.

Re:MIT

[Mars Hill]

Yes there is.

Re:MIT

[Edmund Blackadder]

Well if the MIT networks are at least partially hubbed, which they probably are you can use a packet sniffer.

A packet sniffer will get you some juicy info ... even though it can be thwarted with public key encryption, i think.

Re:MIT

[Waffle Iron]

Any workstation that is pysically accessible to the public is subject to reprogrammning so that it emulates its original behavior plus logs keystrokes. Unless you're using honest-to-goodness dumb terminals with non-flashable ROMs, I wouldn't be so confident.

Re:MIT

[Anonymous Coward]

Nonsense. I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

The real thing to remember is to never, ever, ever use a public system. That is the most sure way to give up all privacy. Even if there isn't a 3rd party breaking into and modifying the public machines, the true administrator of the machine might have all sorts of logging software.

Even if you use something like SSH or SSL, that only products you between the two endpoints. When one of the end-points (the client you are using, in thise case) is insecure, a secured data tunnel is worthless. Indeed, your keys/passwords/etc. can be stolen quite easily.

If you need to compute on the run, get a laptop that you are in control of. Don't use someone else's machine to conduct sensitive business or utilize sensitive information.

Re:MIT

[jd142]

So how do you make a public machine, where random people can come in off the street a multi-user system? Think of people who go to a library to work on the web because they don't have a computer at home.

The problem isn't inherent in single user windows systems, it's quite simple to lock down a windows machine to prevent easy installation of this kind of program, the problem is lack of security protocols on the tech end.

Re:MIT

[AndrewHowe]

Well, finding the root password might be quite easy if the root user happens to log into one of the public computers... Keylogged... Job done.

Re:MIT

[jd142]

I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

Prevent booting from a floppy, password protect the bios and lock the case. Makes it much harder.

You could still do it, but the odds are that someone would notice that you were literally hacking in to the computer so you could set the dip switch on the motherboard to blank out the bios password.

And it should be obvious to the techs who do maintenance that someone has sawed through their lock.

Re:MIT

[Anonymous Coward]

Which goes back to the original article, and the tech's inability to secure the box. You can lock MOST OSes down so this wouldn't happen, if you know WTF you are doing.

Re:MIT

[myrashka]

Oh come on - MIT is a hacker training ground...so people hack the MIT systems all the time...not getting caught is the final exam!)

Re:MIT

[PtM2300]

You don't even need software for this. You can buy a little inconspicuous hardware unit that plugs inbetween the keyboard and computer. When you want to view the keyboard strokes, simply pick up the unit and pop it into your computer. It can then mount as a hard drive.

Re:MIT

[Anonymous Coward]

Surprise! It uses switches not hubs. You lose. And before you come back with an ARP poisoning comment, figure out how it works first so you don't make a fool of yourself.

Re:MIT

[ColdGrits]

*bzzt*

Wrong answer, thanks for playing.

It is easy to get the login details of other users - I did this at Uni myself (many years ago) and over a few weeks I got the username and password of everyone in the department who were using those systems - Suns running SunOS which, last time I checked, is a unix-based system.

(It wasn't big and it wasn't clever, although in my defense all I did this for was to see if people woudl fall for it - I never used the passwords to do anything)

Re:MIT

[Fembot]

what exactly is anthea?

Re:MIT

[LostCluster]

Aside from distracting a logged-in user, pressing the 20-or-so keystrokes needed download to move them into your emulating-interface, and then you have a logger that's at least good enough for that session.

Risks can be reduced, they cannot be eliminated.

Re:MIT

[Magus311X]

Does it use a PS/2 keyboard? If so...

Key Katcher

Expensive, but will work on anything using a PS/2 keyboard.

-----

Re:MIT

[anon*127.0.0.1]

And of course it wouldn't be hard at all to drop a hardware key logger like this on a system, do something to hose up the software, then call tech support.

Odds are if it's a pure software problem the tech will never look at the back of the machine. Once he's fixed the problem and wandered off, you can retrieve the keystroke monitor and you probably have the admin account name and password.

Re:MIT

[Gudlyf]

Or even easier, this.

Re:MIT

[nutznboltz]

The real thing to remember is to never, ever, ever use a public system. That is the most sure way to give up all privacy.

But under certain circumstances anonymity is privacy so some behaviours on a public machine are more private than on personal machines. If you provide nothing but false data about your identity on a public machine (i.e. don't access anything that is connected to your true identity) you can post messages that have high plausibility of denial ("I don't know anything about that post".)

Re:MIT

[RainbowSix]

Don't feel so secure. Here at CMU a long time ago someone stole passwords like this:

When he "logged out" he didn't really log out but he put up a fake password prompt. The next person would log in, but it would say "password incorrect," store the password, log the original guy out, and show the real login prompt.

Don't think you're safe on a multiuser system either.

Re:MIT

[Scarblac]

Nonsense. I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

A floppy? How quaint. Our Linux boxen at the uni don't have drives.

Re:MIT

[ZeLonewolf]

Mod parent up! As long as there's a public access terminal, it's easy enough to make a superfluous "fake login screen" program to log keystrokes and whatnot.

Re:MIT

[karlm]

Ehh.. MIT gives you the root password to all of the public workstations that's why you need to type "access on" at the console in order to access a workstation remotely. I'd advise against this. Kerberos tickets are stored on teh HD until you log out, so somone else can become you for 10 hours (by default) if you turn acess on. The dialups, Kerberos servers, and departmet/private machines are entirely a dfferent matter.

Oh, and su and access commands are supposedly remotely logged. I've been questioned in W20 shortly after logging in as root.

Has anyone out there used the new Win32/Athena machines? I'm affraid, very affraid. Also, is the Administratr password the same as the root password for all of the *NIX workstations?

Re:MIT

[coolmacdude]

No you cannot use a packet sniffer. I'm sure MIT has made this impossible. Here at Georgia Tech OIT encrypts all packets by destination MAC address so only the intended recipient can view them.

Re:MIT

[Anonymous Coward]

Note that you can walk in off the street and use the Athena workstations, too :-)

Re:MIT

[Bastian]

Add built-in keyboards to the mix.

Although these mainly exist for ps/2 keyboards, there are hardware keystroke loggers that plug in between the keyboard and the USB port and are designed to look nonconspicuous.

Re:MIT

[kuhneng]

The only thing that might make those Win32 machines safe is that they present absolutely zero challenge.

I briefly worked on the MIT I/S project to bring Windows to public clusters. The project's official name was "Pismere", latin for horse piss. The test servers were named "frequently-down" and "data-loss". Needless to say, we all considered the project to be an enormous security risk.

I remember finding a nice proof of concept of a security hole when I was there. Found a web site that displayed an image saying "if you see this, I can get your username and password, click here". I clicked, and 2 minutes later the target page refreshed with my username and password! This was 1999, the web wasn't exactly new.

The standard athena unix boxes have a fairly impressive (although certainly not impenetrable) set of defenses. There's a tripwire type system that runs on user logout and disables the system if anything funny is detected. Admins then fix the box by reinstalling from a network server (completely automated).

(for those who are interested, the exploit was accomplished by pointing an IMG tag to a file on a SMB share that was running a hacked version of Samba. The Samba server would claim it didn't understand the modern authentication methods and request a LanManager style login. Windows LanManager password hashes had a flaw that made them fairly easy to reverse.)

Re:MIT

[DragonPup]

Athena, not Anthea.

Re:MIT

[Sarcazmo]

So how do you make a public machine, where random people can come in off the street a multi-user system?

Easy, when someone comes into the library or whatnot, the clerk runs a little program that generates a random login and password and creates the account on an open workstation. You hand the user a little card with their assigned workstation number, and their login and password. When they leave, they give the clerk the card back, and he deletes the account. It could be automated with barcodes or whatnot if you need high volume.

For something like a college where all the students have ID cards, it gets even easier, since they can just use something like NIS or LDAP or Kerberous logins that are valid on any machine. That's what my college did in the public labs.

Re:MIT

[Rolo Tomasi]

Bad idea. Many (most?) BIOSes have a manufacturer default password, which overrides the user password. Most mainboard manufacturers also don't bother changing it (you can view & change it for AWARD BIOSes with a program called modbin, which you will have to obtain illegally). You can also overwrite some of the CMOS RAM (takes about five lines of assembly), so the checksum will become invalid and the BIOS will load the setup defaults on the next boot. No more password.

The BIOS password is useless. Furthermore, even if it weren't, if you install a hardware keylogger, you will get the password anyway. If you want to do it professionally, install the keylogger inside the keyboard's case.

In short, if you have physical access to a machine, the possibilities of compromise (even non-invasive) are endless. And that's not even taking into account fake logins, trojans, OS & app exploits, etc. pp.

Re:MIT

[stuuf]

The real thing to remember is to never, ever, ever use a public system. That is the most sure way to give up all privacy. Even if there isn't a 3rd party breaking into and modifying the public machines, the true administrator of the machine might have all sorts of logging software.

My school library used to have about 20 workstations running windows 2000 hooked up to a Citrix Metaframe server (this year they just turned them into regular w2000 workstations you log on to, but with many security constraints). It didn't take long to figure out that the citrix client doesn't capture the windows key, allowing you to get the start menu of the local computer. One day, a friend and I were hacking around these things and got into the config dialog for the citrix client. There was a page with a bunch of logging options including log keystrokes, log bitmaps, log mouse actions. The school had never turned them on, and they probably wouldn't notice if we started logging keys and stealing hotmail passwords.

One time, I wrote a little C++ builder program that could send and receive mouse instructions through a network connection. I installed it on several of the machines, then I could just start it up, connect to the machine next to me, click the send button, and the watch the kid freak out as his mouse started following mine. Or I could 'monitor' their mouse actions.

They got rid of citrix before i was ablke to finish writing and deploy a network screen capture sending app.

Re:MIT

[Reziac]

Dunno how illegal modbin can be, when it's available for download from ZDNet (among 600+ other places that came up on the most cursory search).

Re:MIT

[Reziac]

Not precisely to topic, but an example of how even systems designed for use by the public have odd holes -- was using the local library's card catalog program and happened to look in "Help, About" to see who made it. And there's all the user registration info and program serial number, hanging out for all the world to see.

Re:MIT

[carsont]

Nonsense. I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

Not if the PROM is configured to require a password to boot from an alternate device, or to boot up at all.

Even if you use something like SSH or SSL, that only products you between the two endpoints. When one of the end-points (the client you are using, in thise case) is insecure, a secured data tunnel is worthless. Indeed, your keys/passwords/etc. can be stolen quite easily.

Or you can use a one-time password system like S/Key for authentication. That's what I do whenever it's necessary for me to log in to my machine at home from campus, anyway.

Of course, this doesn't help you with email or website logins, but it's a step in the right direction.

I doubt if we'll ever see online banking, webmail and so forth adopt more secure authentication mechanisms, but maybe after enough fiascos like this, universities and libraries might adopt a dumb terminals-and-smartcards approach (such as SunRays).

Re:MIT

[MoneyT]

Of course, I would be more worried that it's the techs that are installing this sort of software. These people have all the keys to everything and admin acess on machine (I know, I'm one of em). But, I guess you can't secure for everything now can you.

Re:MIT

[Rolo Tomasi]

Hmm, that's weird. AFAIK it was only intended for manufacturers and was leaked into the public, you still can't get it from Award (now Phoenix) directly. You also can't get it from zdnet.com, only from zdnet.de (the German site). My guess is that Award are just turning a blind eye to this.

Re:MIT

[borgasm]

At my school, our computers were locked down with something called WinGuard (this was a while ago). One of my friends created a fake program that mimiced WinGuard - the login prompt, and all the functions, because the EXE's were hidden from the regular user, but there were ways to access them. It was a spot-on match to the WinGuard GUI. Administrator types in password, program grabs, we check the log file.

This worked nicely because our admins used the same password for everything. In no time we had access to servers, other workstations, etc.

Did I mention how we also dissasembled the binary to find a backdoor password left by the original programmer?

Re:MIT

[Reziac]

Could be -- kinda useless to lock the barn after the horse is miles down the road. (I meant to note it as ZDNet.de, but forgot, thanks.) Maybe it went forth with a SDK?? must have escaped in source form, because there seem to be a variety of updates floating around. http://www.ryston.cz/petr/bios/award.html even has docs (plus lots of links to other good BIOS info and updates).

Re:MIT

[Anonymous Coward]

Quote from the BLURB:

" allegedly installed keystroke-monitoring software"

Key word here - software. This wasn't a hardware based solution.

Re:MIT

[bluGill]

I caught a kid doing that in high school, waited until he left, and then quit his program (control-c) and deleted all his files. I hope he had important stuff.

Note, the system was novell 4.x, and his program was just a qbasic script. Nothing fancy, it wasn't even work to break it. I suspect that he wasn't loging passwords, but I had already heard of other people who had logged password so I wasn't taking any chances.

Re:MIT

[Mike1024]

Hey,

Prevent booting from a floppy, password protect the bios and lock the case. Makes it much harder.

You can get hardware keyboard loggers. They go between the keyboard and the case. They're fairly cheap, and availiable to consumers.

Alternately, you could use a BIOS master password. Look them up on Google; many popular bioses have them.

Just my $0.02,

Michael

Re:MIT

[Kruid]

I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

Really? How many work stations, today, have floppy disk drives ?

hmmmm...

Re:MIT

[Anonymous Coward]

Except that they basicly invented kerberos. Passwords are probably NEVER sent in plain text.

Re:MIT

[Greyfox]

Easy solution to that one too. Remove the public machine's floppy and bootable CD ROM and store user document files in their password-protected user space on the network.

That doesn't defeat hardware keyloggers though.

Re:MIT

[Jester99]

This is why modern WinNT's make you press ctrl+alt+del to bring up the login prompt. You can't intercept that key combo.

Re:MIT

[Anonymous Coward]

that came right to my mind when I read the article, I remembered it from the KGB underground tour

Re:MIT

[Chester K]

When he "logged out" he didn't really log out but he put up a fake password prompt. The next person would log in, but it would say "password incorrect," store the password, log the original guy out, and show the real login prompt.

Don't think you're safe on a multiuser system either.

A Windows-based multiuser system would be safe from this sort of attack. Windows servers can be set to require the user to hit the system key combination, Ctrl-Alt-Del, before entering their login information. Ctrl-Alt-Del is not trappable in any fashion by any userspace program and can be set to always transfer control to the system. If you're on a Windows server and you hit Ctrl-Alt-Del, you can be absolutely sure that the window that pops up next is a legit system dialog.

Re:MIT

[FunkSoulBrother]

whats interesting about that thing, and the one the parent posted is that they only have 64-128K memory. Throw in a couple megs, its the 21st century. Then you could have some fun with the thing. Otherwise it's getting full quickly on a public computer.

Re:MIT

[FunkSoulBrother]

I stand corrected, there is a 1 and 2 meg model at the parents site for an obscene price. I suppose thats just the nature of the hardware-keylogger market.

Re:MIT

[Blkdeath]

You can get hardware keyboard loggers. They go between the keyboard and the case. They're fairly cheap, and availiable to consumers.

Pardon my ignorance, having never laid eyes on the public systems referenced at either University, but how open, exactly, are they?

A few things come immediately to mind; why not encase the whole system, including keyboard connectors et al, in an external case? (Not a PC case, but an enveloping case that might even include the monitor) Also, why even have a floppy or CDROM drive attached? Makes securing the BIOS password a lot more pointless if you now have to cart around a set of lock-pick tools, a spare floppy drive and ribbon, and be able to perform surgery on the box while nobody's looking.

If these truly are desktop machines, open and exposed to the world in all their glory, it seems to me as if they'd be the last machines I'd trust with my PIN, credit card, bank card, or any other personal details. Casual web surfing only, thankyouverymuch.

Re:MIT

[Anonymous Coward]

*bzzt*

Wrong answer, thanks for playing.

Yeah, I stopped reading after I saw this condescending BS.

Trust me. It's entirely possible to make your point without being a jerk.

Re:MIT

[Blkdeath]

> I can easily hack into a UNIX system without nothing more than a floppy disk and the power switch.

Really? How many work stations, today, have floppy disk drives ?

Most of them.

Nevertheless, s/floppy/cdrom/

Re:MIT

[Anonymous Coward]

Or you are in terminal services...gee there goes that theroy.

Re:MIT

[Fulcrum of Evil]

Here at Georgia Tech OIT encrypts all packets by destination MAC address so only the intended recipient can view them.

Well, that shouldn't be a big deal - just get a list of active MAC addresses. You can do this by sniffing ARP. If you can't get a list, try brute forcing the MAC space for popular manufacturers (on campus). 16 million attempts per manufacturer for 2 or 3 manufacturers should get most NICs on campus.

Now, making all the network links switched will eliminate you ability to sniff packets (save for WiFi) and render the encryption issue moot.

Re:MIT

[anethema]

Yes, i was helping a sysadmin with some security for his winnt machines. I told him that within the next couple days i'd have his admin password.

His network worked in the way that if you leave a machine alone for too long, it locks itself and you need either the password of the person logged in or an admin password to unlock it. He did this so people couldnt just walk up to the machine while it is unattended and install keyloggers, whatever. Thought he was so clever..

I downloaded some cheap program that simulates a winnt lock screen, called another sysadmin over and told him that someone had left the lab and forgot to logout and i need to use this computer.

He types in his pwd, goes away, and i read the log file the thing makes, blammo, there is the password. I emailed him his password and he was pretty stunned. And this any stupid user could do.

The moral of this story is, for every fix, there is something else to break, so never be confident, always keep your eyes open because some smartass kid is probly going to figure out a way to get around all your careful preperations.

Re:MIT

[Anonymous Coward]

If the machine is running lilo chances are its fairly simple to get root from lilo since almost nobody remembers to add "password none" to secure lilo.conf. No distro I know of secures lilo by default and most admins simply overlook this. At NYU this was a problem a few years back, but since most machines at NYU dont run Linux it wasnt a major problem and ended up fucking over only a few CS students.

Re:MIT

[Creepy]

If you have access to the inside of the computer, all you used to (and still for some manufacturers?) need to do is pop out a single chip. I used to do this occasionally when fixing computers (for a major PC manufacturer), usually because the password was forgotten and they needed it reset (meaning a new chip, unless they no longer wanted power on password, in which case all you needed to do was pop the chip and throw it away), or they were having controller problems (drives can be swapped into non-protected test bays easily enough, and can be surface scanned and write tested even if the contents are scrambled). Unless you have a lock on your case this security was pretty much useless.

The manufacturer security password you're talking about may be the "new" way of doing this (apparently in CMOS, not a separate EPROM), so popping the chip is unnecessary. I'd hate to think that's true, unless it's usable only by a EPROM reader, because anyone who gets that password can get in (and hackers will have that password published on 40 different sites two weeks before the machine hits market). I'm pretty sure invalidating the CMOS wouldn't reset the security chip, at least not on the machines I worked on about 7-8 years ago (BIOS upgrades didn't do it, at least).

Re:MIT

[mentin]

50 characters a minute x 60 min/hour x 24 hour/day = 70KB per day. Given most users of this public computer don't type continuously, but browse the web, I think 64k-128k is OK.

Re:MIT

[iotaborg]

Are there really, for USB? From what I understood, USB is encrypted, though not that much.. but I doubt such a device could decrypt it fast enough.

Re:MIT

[Anonymous Coward]

Ctrl-Alt-Del is not trappable in any fashion by any userspace program and can be set to always transfer control to the system. If you're on a Windows server and you hit Ctrl-Alt-Del, you can be absolutely sure that the window that pops up next is a legit system dialog.

No. You can only be sure that you're safe from a purely userspace logger. If the system is compromised all bets are off. Not that it isn't a useful feature but trusted path is hardly new.

Re:MIT

[Atzanteol]

Now, making all the network links switched will eliminate you ability to sniff packets (save for WiFi) and render the encryption issue moot.

Are you sure? Arp-poisoning can get around switches easily. Check out ettercap

Re:MIT

[arlow]

C'mon guys -- everybody knows that you have to type in the SECRET PASSWORD at the keypad at the door to get into the Athena clusters -- that way only honest people have physical access to the computers... :D

Re:MIT

[Bastian]

I would suggest that replacing a PIII with a VT220 can be reasonably considered a hardware based solution.

Re:MIT

[Anonymous Coward]

Well, with a little cunning I'm sure someone could easily attach one of these without anyone noticing. So, so much for trying to secure the box.
Course, it currently only works for PS2 keyboards.

Re:MIT

[Chester K]

If the system is compromised all bets are off.

Oh, absolutely. What I meant by "legit system dialog" isn't that its legit in the security sense, just that it's guaranteed not to be a simple subterfuge set up by another normal user on the system like the parent post described. That's where trust comes into play: you have to trust the system (and its ability to keep the trusted path unmolested), but not necessarily the other users of the system.

Re:MIT

[mandolin]

When he "logged out" he didn't really log out but he put up a fake password prompt. The next person would log in, but it would say "password incorrect," store the password, log the original guy out, and show the real login prompt.

The Secure Attention Key (SAK) is there for just this purpose. Although according to this it has had issues.

Re:MIT

[p0et]

Even with terminals, you could hack them! :)

At my university, there were a few rooms with good old VT's, which allowed to change the key combination of how to switch the session. To login we used to do something like: rl -l login server, then it prompted us to enter the password.

It was just a question of changing the switch session to Ctrl-J (that is, enter...), and voila! after the user entered the password, it was sent back to the login, with a background session running.

Of course many of the people started to knew the trick, but still got many people unaware.

Re:MIT

[Anonymous Coward]

modbin or another prog

http://www.xs4all.nl/~matrix/master_password_lis ti ng.html

Re:MIT

[coolmacdude]

Everything is switched. So there is that plus the encryption.

Re:MIT

[Anonymous Coward]

Providing a trusted login path is an old-school feature solving an old-school problem common to any multiuser system. Windows NT's parent, VMS, can be configured to require a similarly untrappable "break" key press.

Re:MIT

[Dungus]

Its not encrypted, it just has a lot of protocol overhead. Many bytes are sent to relay a single keystroke to the host PC. There are devices which can decode this. I have one on my desk here.

Re:MIT

[jd142]

Easy, when someone comes into the library or whatnot, the clerk runs a little program that generates a random login and password and creates the account on an open workstation. You hand the user a little card with their assigned workstation number, and their login and password. When they leave, they give the clerk the card back, and he deletes the account. It could be automated with barcodes or whatnot if you need high volume.

Good idea, and we do something similar with reserve computers and a checkout floppy. But for public kiosks there are some additional problems.

I come into the library at 10:00am. I get my name and password walk over to computer 3 and do some research. Then I go up to the fourth floor and work in the stacks for an hour. Do I have to go back down to the main floor and use computer 3 to do more research? How long is my password valid on that computer? What if someone else is using it?

While this is a good idea, I don't think it would work for anything but reserved computers. I'm making a distinction here between would I would call kiosk computers, computers that are in place in various public areas that require no or minimal user intervention to use. Reserved computers would have more apps on them, maybe in a small room or carrel that people could use to write papers with. For those kinds of computers, your idea works great.

Ideally, I would have a diskless terminal station for a kiosk computer, but that isn't always possible. It's actually cheaper to use old machines that are past their prime than to purchase even the cheapest terminals.

Re:MIT

[chiph]

Ctrl-Alt-Del is not trappable in any fashion by any userspace program and can be set to always transfer control to the system.

It's known as SAS - Secure Attention Sequence.

But if you have a program that looks like the NT/2K/XP login screen, your typical user will think: "Oh, someone already hit Ctrl-Alt-Del, so I don't have to.", and enters their info. Program then records info, and logs out. User then repeats sequence and gets in. (A drawback to the technique is it's a one-shot deal).

As Kevin Mitnick will tell you -- a big part of security in an organization is having trained users.

Chip H.

Re:MIT

[Bert64]

I wonder how secure the SUN PROM, DEC SRM and SGI PROM is when configured to boot immediately to an os and require a password to access the prom console itself... I`ve heard of people returning their machines to the manufacturer to be unlocked.. and many machines on ebay are advertised as having no prom pass set.. So i doubt these systems are as insecure as an x86 bios.
Also these systems run unix os`s, therefore you would need to gain root before you could run a program for overwriting the prom settings.
Ofcourse its still not totally secure, but its a far better solution and would likely stop most attempts.
Also, placing the physical machines inside an enclosure, so that only the keyboard/mouse and monitor are physically accessible would be a good idea, the "easyeverything" cybercafe`s do this.
Ofcourse you could still pull the keyboad cable out, but you would never get it back in.

Re:MIT

[Bert64]

Any scriptkiddie on irc will show you logs that prove otherwise.

Re:MIT

[Bert64]

But why would the admins log in to the public terminals? Surely they have their own office and their own machines, from which they can ssh and/or telnet.
I worked at a university, where we NEVER went to a computer room unless the machine was unreachable from the network... And if that happened, unless it was a cabling problem, the machine would be returned to our office and investigated, most likely ending up being formatted and reinstalled.

Re:MIT

[karlm]

yeah... I tried out the new Pismere cluster last weekend... noticed that the machines have 10.x.y.z IP addresses. (MIT has all of 18.x.y.z, so it's not like they're hurting for IP addresses. Hell, my oldfraternity house was zoned for 22 residets but previously had been allocated a /16 subnet.) The only thing I could think of is that you guys decided to ditch the standard MIT "firewalls suck" policy in favor ofthe "firewalls suck, but not as much as Win32 security" policy.

--begin tangentstorey about MIT security policy

I was an RCC when a few of the guys passed around a CD for Win2K advanced server... and they ALL accidently installed IIS, which is part of the default install... and ALL got broken into within a few days... I emailed everyone after the first breakin to tell everyone to make sure they patched IIS if they were running it. I got an email back from one of the guys "what's IIS?"... and discovered he was running the default IIS page. He got owned before I got back from campus to talk to him about it. In fustration, I asked Network Security about advice on firewalling. I basically got a "firewalls suck, just make sure everyone's up to date and scan often" reply. I had a hard enough time getting people to take down cracked achines, much less stay up to dte on patches. I actualy had one guy go and reconnect his network drop to the switch after I forcably disconnected him for having a cracked machine (it was actively being used for attacks whose victims complained to MIT Network Security.. who complained to me... etc.). I think there's still at least one guy with his whole HD shared on SMB. You can only beat people over the head so much if you don't have any real power over them. (RCCs seldom have any real power.)

Re:MIT

[karlm]

P.S. Any idea the rationalle for making the LM hash 8-bit clean, but then changing everything to upper case? There's no excuse for doing away with the salt, and then keeping the salt out of the NT hash. They clearly based the LM hash on the UNIX crypt function, but every major change made it weaker. Was there pressure from government to make the security lax or something? (RC4 key reuse for two adjascent 128-bit pieces of data to "encrypt" the password file? Come on. I know it's a little slow to crack the LM hash using an abacus while drunk, but MS really should have asssumed attackers have access to a 68010 or at least an 8051 or a z80.)

They may be shared machines

[Marqui]

But why weren't they locked down to prevent installations of software, etc?????? You would think that the admins should be on top of this. I know it's easier said than done, but it seems that someone should be watching this stuff!

Re:They may be shared machines

[tekunokurato]

You know, there's something to be said for allowing users some degree of freedom. It's quite easy to cut off all kinds of access, but networks that have users with a wide variety of needs and interests and who can generally trust their users shouldn't do so.

At my school, we've got some computers in very public areas that are all full of restrictions, and people run into usability problems with them all the time. But on the computers in the library, users can install whatever they need. If I need to install a drawing program to help create a presentation, I should have the freedom to do so. If I want to install AIM to get files off my computer remotely or send myself information, I should be able to do this. These are important user rights in a computing age.

As such, it is important to monitor what is being placed on computers, but it is foolish to restrict everything outright.

Re:They may be shared machines

[Beetjebrak]

At my workplace we have locked-down Win2K workstations. Software installation is "impossible" on them. However, there is always some bit of the system's harddisk that's writable to me. c:\winnt\temp does the job well in my case. I can put whatever single .exe I want to run there and start it from any explorer window. That's how I run a VNC-viewer to log in on my home Linux box, and PuTTY for when I just need a quick terminal. Occasionaly my .exe's disappear, but I just put them back in and it keeps working. I'd guess executing a key logger wouldn't be much more difficult..

Re:They may be shared machines

[anon*127.0.0.1]

Thats a good point. Maybe the answer is to have two different kinds of systems.. open systems that anyone can use, and do whatever they want, and a smaller number of "secure" systems. Secure systems would be locked down a lot tighter, maybe reloaded after each user, and you'd be much more limited in what you could do on them. But users could do their banking/love letter writing/whatever in relative security.

Re:They may be shared machines

[Anonymous Coward]

they aint your computers, if you want to install stuff do it on your own computer, unless you want to pick up the labour bill cos some idiot clicked on a virus/trojan/keylogger and infected the network or installed something that damaged the machine(s).

you cant define whats ok and whats not when it comes to installing stuff, its either full rights or no rights and frankly as a sysadmin ill take the latter

Re:They may be shared machines

[tuxlove]

But why weren't they locked down to prevent installations of software, etc?

Locking down the machine is a start, but there are enough local exploits on Windoze that an attacker could get in without an unreasonable amount of effort. And, unless the machine has no floppy, or has a password-protected BIOS to protect the boot configuration (with floppy disabled), there's always the boot-from-floppy approach. It's always best to assume that if someone has physical access to a computer that it's been owned.

Re:They may be shared machines

[packetgeek]

This idea of letting users install "whatever they need" is how organizations get busted for licensing ifractions. Besides that, who says that the software a random user installs is stable and will play nice with the other software on the system? Should the people responsible for system uptime/availability be expected to spend precious resources scouring a facility for illegal software and fixing machines that were needlessly broken? IT departments are charged with providing the required services to all of the authorized users with as much efficiency to the users as a whole as possible. Not trapsing around after a small handfull of users who think the systems are their just for them.

Re:They may be shared machines

[RAMMS EIN]

The Right Thing, IMO, for public computers, is to allow users to do whatever they want - in their own home directories. Their resource usage can be restricted with things like quota, nice, or rlimits. If you don't want them to run servers, firewall them. With proper separation of processes and proper access rights, users will not be able to spy on one another, unless one user enables another to do so. If a system does not allow proper separation of users' data, it is simply not suitable for a multi-user environment.

Re:They may be shared machines

[Tack]

You know, there's something to be said for allowing users some degree of freedom. It's quite easy to cut off all kinds of access, but networks that have users with a wide variety of needs and interests and who can generally trust their users shouldn't do so.

A nice sentiment from someone who is obviously not a sysadmin of any non-trivial setup, or from someone who is fortunate enough not to be overworked and have plenty of time to do one's job.

The problems with giving users free reign on public/lab systems are several. The biggest one is that letting users install whatever they want can leave behind god-knows-what, like spyware or trojans. Also, it's easily possible for installing a piece of software to break another, more important piece of software. When that happens, since I'm the admin, it's my job to fix it. Of course since I have so much free time and generally do nothing all day except post on slashdot, this isn't a problem, right?

Another issue is licensing, and that's something most users, even ones competent enough to install software, don't take into consideration. They install their copy of Corel Office on the public/lab system because that's what they used at home to do their presentation or document, and suddenly there are legal implications to the organization servicing that computer.

If it's your computer, that's an entirely different story. For example, Microsoft has no business mandating what can and can't be installed on your computer. But if the system is an asset of my organization under my administrative control, you better believe I'm going to lock it down. My job is to make it very easy for users to do authorized tasks, such as web browsing or word processing, and very difficult for users to do unauthorized tasks, like installing foreign software, or accessing/deleting data that's not their own.

Jason.

Re:They may be shared machines

[mortonda]

That's what programs like Ghost are for... if a user installs something that breaks other programs, just ghost a fresh copy of a known good configuration back over the hard drive. All trojans, viruses and broken programs are gone.

Re:They may be shared machines

[Reziac]

While I agree with you re all the problems install access can generate, would this be practical:

Whenever a user logs in, they get their own VM. They can install whatever they like and abuse their VM however they want. When they log out, their VM (and everything installed therein) goes away.

Re:They may be shared machines

[GePS]

Symantec. Ghost. Console.
If anything goes wrong, hose the entire room.

Re:They may be shared machines

[bryhemm]

My school used pc-rdist to restore systems to a standard state everytime a user logs out. Now they are using something called Go-Back, it does the same thing, but its faster.

I can install whatever I want on a lab computer, I can even restart without hosing the system. When I'm done, I log out normally, and everything goes back to how it was.

Re:They may be shared machines

[Xerithane]

Whenever a user logs in, they get their own VM. They can install whatever they like and abuse their VM however they want. When they log out, their VM (and everything installed therein) goes away.

Yes, it's entirely feasible. JWZ did this for his nightclub.

Although I don't know if Windows is flexible enough to let you do something like this...

Re:They may be shared machines

[Anonymous Coward]

> Although I don't know if Windows is flexible enough to let you do something like this...

Experts estimate Windows won't have the capability to do this until mid-1991 at the earliest.

Re:They may be shared machines

[Anonymous Coward]

I WAS such an admin when I was in college, and we took basic steps to secure the machines. You could get around it if you tried, but we had a solution for that.

Every couple of days, we would blow away the machines, and install fresh images on them. Their OS was never more than a few days old. We would have done it more often, but most lab ops are lazy.

Re:They may be shared machines

[Anonymous Coward]

At our school computer lab, we just re-imaged each machine in the boot process. This way, people could install anything they wanted, but it dissapeared when the machine re-booted.

Re:They may be shared machines

[Blkdeath]

That's what programs like Ghost are for... if a user installs something that breaks other programs, just ghost a fresh copy of a known good configuration back over the hard drive. All trojans, viruses and broken programs are gone.

That idea works well in theory, until you start to imagine a network of 500 computers with 2000 users. Administrators are over-worked as it is, without having to do walk-through inspections and surveys of all computer labs all day long to find out of some of the machines need re-imaging.

Ghost is a great solution for mass-distribution of an OS/software config, but it's not a solution to users tampering with local systems. Not by far.

Re:They may be shared machines

[Anonymous Coward]

Why don't you keep a disk image of your basic lab setup and re-image the machine when a new user wants to work? Re-imaging takes only a few minutes at the most.

Re:They may be shared machines

[Anonymous Coward]

Er... you don't have to do walk through inspections and surveys of all the computer labs to use Ghost.

You simply reghost the machines via the network each night/week.

Re:They may be shared machines

[murgee]

We do that. Though, now we're looking into software that restores the machines automatically at logout. (I forget what it's called.. driveshield or something?) Public access computer labs have horrendous problems with people installing Kazaa and whatnot and, therefore, Gator and whatnot as well.

You could probably fanagle a combination of System Commander and Ghost to do the same thing, too - reboot and automagically reghost, using the image on a secured part of the hard drive.

Re:They may be shared machines

[Reziac]

[looking] Nice setup; looks like this guy thought it through rather thoroughly. Thanks for the info!

Re:They may be shared machines

[Blkdeath]

Er... you don't have to do walk through inspections and surveys of all the computer labs to use Ghost.

You simply reghost the machines via the network each night/week.

You also have to find out which machines are defective during their daily/weekly usage, isolate their identity, then connect to your server and initiate the process. Otherwise, you could have upwards of hundreds of people having to share a machine or do without. (And believe you me, there are students out there vindictive enough to disable workstations the day after their weekly imaging to ensure maximal downtime). The failure rate for imaging such large quantities of machines is entirely too high to be done on a regular basis. It would still require a small team of admins to walk the network and ensure that all labs are functional (ie; waiting at a login prompt, and able to be logged in, not conflicting with another machine (network ID has to be unique; the post-image process has to be undertaken sucessfully)).

I just love how so many armchair sysadmins on Slashdot have the perfect network strategy figured out.

What you're not considering, of course, is the traffic generated during the time this individual has has ${SOFTWARE} installed on the workstation, what traffic and/or data have been transmitted to countless sites on the Internet, and what potential nasties have been brought into the "trusted" network that is now sharing data pathways with all the students' reports, term papers, assignments, financial data, and personal information.

Ghost is a great product. For what it does, it's absolutely fantastic. I would highly reccomend it for any mass network software deployment. I can't sing its praises highly enough - honestly. However, Ghost is NOT designed to protect the network against users tampering with workstation configurations. In the network security / data integrity chart, Ghost is but one of many tools (including group and user policies, physical security, firewalls, IDS, etc.

Only when all other tools and automated protection systems have failed does Ghost come into play.

Imaging labs, or even small groups of workstations is entirely too taxing a process to be undertaken on a highly regular basis.

Re:They may be shared machines

[Xerithane]

Nice setup; looks like this guy thought it through rather thoroughly.

By this I'd assume you don't know who he is, which sucks, he's a cool guy. Definitely peruse around jwz.org and read up on him, you'll want to keep track of his work :)

Re:They may be shared machines

[Reziac]

Nope, don't recognise him (at least not yet :) but I did bookmark and plan to come back when I have time to wander around.

This, of course, is one reason I hang out HERE -- the occasionally cool link. Thankx!

Re:They may be shared machines

[shaldannon]

I'll spoil some of the fun of reading the site...JWZ is the man behind the ever popular Xscreensaver suite. Enjoy reading the rest of the site.... :)

Re:They may be shared machines

[tekunokurato]

A nice sentiment from someone who is obviously not a sysadmin of any non-trivial setup, or from someone who is fortunate enough not to be overworked and have plenty of time to do one's job.

Thanks for the personal attack there, Jason. You're absolutely correct- I'm not a sysadmin at all. I can see you're bitter towards people you feel have it easier than you, but come on- you really don't know anything about me. I'm not going to defend myself to you, because this sort of personal debate is really just whining.

However, this is what default states are for. As one above user suggested, try Clean Slate. It'll essentially reset the hard drive whenever you tell it to.

Another option is to partition the drive, and only allow users access to one of them. Then, you can just wipe that one, while using the other one for the OS. You can keep a default registry, etc. so you can just replace the few things on the boot drive that the user CAN change.

I have used several other systems that use this sort of system, and they're MUCH better than the alternative. My college pays its IT people well, and we keep enough of them staffed so they rarely have to work overtime, except in the case of major emergencies.

In conclusion, don't act like all users are bad or ignorant. Just let them do what they want, and clean up after them. That's what a sysadmin is paid for: cleaning house. It's an honorable profession, and users appreciate a well-run system.

Zealotry.

[Anonymous Coward]

So, your a zealot. But, I'm trying to figure out which. Are you;

An MIT zealot.

A Unix Zealot.

A bash Microsoft at all chances zealot.

Or all of the above.

This isn't about systems, or schools, or companies. It is about a thief. An identity thief that used computers to do his crime. Get over yourself.

Re:Zealotry.

[Ibag]

I think the point was not that "MIT and unix rox0r w00t!" but more that there are ways to avoid problems like this. Had they implemented a system like the one at MIT, a software based attack would have been much harder, if even feasable at all.

To say, "No, you mentioned unix and MIT so therefore you must be a zealot and cannot have a point," is stupid. Saying that the useage of computers is irrelevent in this case is just as ignorant. The point of the story was not just to say crime happens. By alerting people to specific kinds of crime, people know to be cautous or to look for ways to avoid being victomized. For example, if the article was about someone using a defect in a specific brand of lock to break into houses and steal things, would you claim that the story isn't about locks or defects but instead only about a thief and his breaking and entering? I should hope not. More likely, you would check to make sure that you weren't using that kind of lock and if you were, you'd replace it to make sure you weren't vulnerable. Just because there is a theif does not mean that the general problem and solutions to it must be ignored.

Happened Here Too

[Anonymous Coward]

Happened at WPI a few years back. After taking an assembly class that showed him how to catch keyboard interrupts, he loaded a new interrupt handler that logged the keystroke and then called the real handler so that everything looked normal. He was caught, but I'm not sure what happened to him.

Re:Happened Here Too

[Anonymous Coward]

Its happened numerous times at WPI.
Usually the person gets caught using the info (logging into a hacked account, for example), rather than stealing keystrokes.

Re:Happened Here Too

[KIondike]

Geez...I go to WPI (sophomore), and I didn't realize that happened so often. Know any names?

Re:Happened Here Too

[_xeno_]

I'm a sen - oh, right, er, junior - at WPI (year off, not that many NRs - yet), so I'd go ask Sean O'Conner down at NetOps or ask the people at the CCC. They're friendly people, as long as you're not being a dipshit and doing something like, oh, I don't know, installing keyloggers, and would probably be more than happy to tell you the stories about people being morons. (Although probably without specific names. Just the events.)

I actually haven't heard anything about this, but I'm going to preemptively blaim Dabion (his screen name), since he claimed he could do it. :) I've also met people who've claimed to have compromized root on the CCC machines, and read everyone's e-mails. Generally, it's not worth trying to be "1337" with the WPI network or computer systems -- you're probably going to get caught eventually, and the NetOps and CCC staff are more than happy to turn people in, resulting in penalties can be as severe as being expelled. (Not to mention whatever laws were broken...)

What I find amazing:

[prichardson]

The guy only managed to steal $2000? This guy must be stupid.

Re:What I find amazing:

[RodeoBoy]

He was only stealing from students. How much do you think he would find. ;^)

Re:What I find amazing:

[gtaluvit]

What college students do you know with more than $2000?

Re:What I find amazing:

[prichardson]

I know I shouldn't reply to my own comments, but this really needs to come out.

Students are not poor. If you live in a university town like I do you can see all of the really nice stuff that gets thrown away by students. A lot of them have ass-loads of money from their parents. I know there are also a lot of struggling students, but with personal info on more than 4000 people, he should be able to do better than that.

Re:What I find amazing:

[Anonymous Coward]

You are obviously not scholarship material.

Re:What I find amazing:

[glesga_kiss]

Yeah, I know! He should have stolen millions, lied about it, gave money to the Bush campaign, and he'd have never gotten arrested!

Re:What I find amazing:

[jogie112]

He averaged less than 50 cents per person.

Re:What I find amazing:

[Anonymous Coward]

Excuse me, but what the fuck are you talking about?

Re:What I find amazing:

[Ramze]

You must be living near Princeton or Yale, then. Most students are dirt poor and surviving off college loans, scholarships, credit cards, and a part time job to pay the bills. I am a college student & I transferred from a major college town (Columbia, SC -- heart of USC) to another college & in both situations, it was rare to find a student who wasn't in debt up to his ears and moaning about how he can't afford to go out to eat much or buy a new computer, etc. I'd say out of 4000 students, he was lucky to find one or two that actually had credit left on thier Visa cards & he maxed those out... lol. We are talking about students here... not their rich parents. Even the rich kids usually have to call daddy for cash every 2-4 weeks b/c they blow it all so fast. It's actually funny, b/c the rich kids are usually the ones w/ out anything at all in savings and little to none in checking except for that breif period when it's deposited by their parents and spent by them on their new toy.

Re:What I find amazing:

[La Temperanza]

Actually, this is a good technique. Laundering tiny amounts of cash is one way to lessen the chance that the fraud will be noticed or addressed by the victims. Some crooks have amassed thousands and even millions by swiping a few pennies from every transaction made on a certain banking system.

Re:What I find amazing:

[catch23]

actually he didn't manage to steal much. Because he stole data on a 2.4Ghz computer, it was the equivalent of stealing $2000. All he did was steal notepad.exe from the computer.

Re:What I find amazing:

[Anonymous Coward]

Everyone at Princeton. I've stolen bikes there worth more than $2000

Re:What I find amazing:

[Patrick13]

My first thought was that jeez, that's only 20 bucks per machine. Calculating 5 minutes or more per machine to install the program (going from computer to computer, from lab to lab over a number of days), plus the time to collect and sift the data, then put it use... He was only was stealing for minimum wage or less.

Get a job at McDonalds ya loser.

Re:What I find amazing:

[Anonymous Coward]

hey. i wouldn't say i'm a rich kid, but my parents help me with some stuff. when my parents deposit money, i use it to pay rent and buy food, no new toys. then i have my job so i can pay for electricity and heat and maybe take my girlfriend out to dinner or something.

if i was a rich kid, i'd have a car, and so on.

don't say everyone getting money from their parents is spoiled rich. it just makes you look stupid for stereotyping everyone.

Re:What I find amazing:

[Anonymous Coward]

Never mind; you wouldn't understand. The person who wrote the joke actually reads the news.

Re:What I find amazing:

[exhilaration]

That's because most college students are stupid.

I'm sure you live in a nice rich college town, but you should pay a visit to CUNY, in NYC, or if you really want to put your life in danger, Rutgers-Camden, in southern New Jersey.

Re:What I find amazing:

[Anonymous Coward]

People have money everywhere. College/university is no exception, and probably reflects the general population.

Re:What I find amazing:

[cyb3r0ptx]

Or, he could have donated it to the Clinton 'Library' and gotten a pardon!

Re:What I find amazing:

[Anonymous Coward]

Enron, you idiot. Give enough money to the right people, you are no longer a criminal.

Re:What I find amazing:

[gauauu]

Or the University of Illinois, or many other large campuses. It amazes me how much crap the "poor struggling college student" buys, and how much money is spent on new toys every week. Most of them are far from poor, and it's not just around Princeton, Yale, and other "rich" schools.

Nothing new...

[shaklee]

There is a kid doing this at almost every school, most of the time it goes undetected. Three people at my highschool did the same thing and were suspended, no one knew what kind of information they obtained but it was going on for over a week.

Re:Nothing new...

[cperciva]

When I was in high school, I had to write a TSR to do this. You kids have things easy these days...

Re:Nothing new...

[painkillr]

I'm also guessing your high school didn't have Internet access "back in the day".

What would you have gotten? Poorly written essays?

Re:Nothing new...

[cperciva]

What would you have gotten? Poorly written essays?

How about the network administrator's root password?

Re:Nothing new...

[cervo]

Back in high school for me they used novell so it was super easy. We forged a fake login screen and then called the real one, so after capturing a user name and password it would log it to a file on the C drive. Totally undetectable that it was any of us. We got a supervisor password and made life a living hell for our net admin. We gave random users supervisor rights and used their accounts based on other passwords we stole to have fun. Sometimes we would give group EVERYONE supervisor rights. People have been doing this kind of thing a long time. Our downfall was the net admin figured out one of the supervisor accounts of a guy who was fired was logging in, then set up a trap and boom caught us.

This guy was clearly more enterprising in that he stole some money, but the question is why didn't he steal more money? And what is with this installing ready made programs, now it is too easy. In the past you had to make TSR's, forge login screens, alter commands and so fourth it was actually not hard but not every idiot could do it. Now you just go to a website and download a packet sniffer or keystroke recorder. It is too easy to do. And because it is too easy to do you'd think net admins would be more aware and capable.

But then again all these compromised systems are non UNIX like. It is hard to compromise a UNIX system without root access. And joe public can't necessarily get his hands on root access or exploit a bug to steal it so at least UNIX is somewhat secure.

Also from the tone of the article it sounds like the college thinks that maybe the prosecutor went too far. The college seems to be more forgiving. For example "Smith said, noting that Boudreau could have used it with far more devastating consequences. ". So the security consultant is pointing out he could have done worse. And so is the spokesman for the college 'While we are grateful to the attorney general's office for their assistance in this case, it's important to state that Mr. Boudreau gathered personal identification numbers on students but never misused them in any way," said Jack Dunn, a spokesman for the college.' At least the schools aren't blowing the case out of proportion like the prosecutor is. Although he did steal $2000 so he shouldn't walk. It's one thing just to login and play pranks, but it is quite another to steal money or do other things.

Re:Nothing new...

[Jucius Maximus]

"What would you have gotten? Poorly written essays?"

"How about the network administrator's root password?"

Heh, I didn't need a keyboard logger to do that. :-) It turned out to be the same as his netbus password which was easily extracted from the Windows registry of lab computers.

Re:Nothing new...

[Bug-Man]

No, it's definitely not new. One of my friends and I wrote one once so we could record our High School Admin's password, and we did, too.

What did we find when we got in there? He'd kept archived copies of some of my friend's home directories. No doubt this was because they're better programmers than he ever was or could be.

Mind you, we almost got expelled, but because we didn't actually use our new-found privileges for anything damaging over the course of the several months we had access, they were lenient.

The lack of damage of course, didn't count the amount of times we stuck a steel rule in a computer's floppy disk drive and whacked the hell out of it. But we were students.

By the way, it was 'clearwater.' The password, I mean :)

Re:Nothing new...

[Anonymous Coward]

Some kids at my school stole a whole bunch of passwords with a keystroke recorder, and last I heard some of them still worked (over five years unchanged). You can't fix stupid users.

Re:Nothing new...

[DarkSotM]

Reminds me when I put a keylogger on my less-then-tech-savy teacher's computer. I was able to get the password for the gradebook program they used. Needless to say I had an easy term that year.

This software...

[Chicane-UK]

This kind of software causes a real headache for system admins.. I speak from personal experience. Our team of about 12 technicians look after approximately 1500 workstations, and about 2/3 of those are used by a theoretical maximum of about 6000 students on a weekly basis.

Trying to keep tabs on this kind of thing can be nigh on impossible.

We have found some software that does work pretty well though - a company called Fortres Grand sell a package for Win9x/Me/2k/XP called Clean Slate that basically resets the machine to a previous state every time it is rebooted. If you wish to add software, you disable it, and put it back on once the software is installed. The machine then works from that 'save point'.

We try not to make machines 'too tied down' for students (like blocking downloading, any changes at all) so this software is ideal and not too intrusive.

No, I dont work for Fortres Grand but thought it seemed appropriate to the subject! :)

Re:This software...

[Cirvam]

Why not just lock the user from writing to most of the hardrive but allow them acess to a temp folder or a network drive where they can install stuff and save stuff. Then when a new user logs in just have a login script wipe the local directory and connect to the new users's network drive? Otherwise students could install stuff like back orface or sub7 and screw with the computer until it is rebooted. I don't know exactly how well Clean Slate works, but it seems that XP has all that built in (doesn't it even allow you to rollback to a previous setup?) although if its anything like their desktop lockdown program its pretty easy to bypass.

Re:This software...

[sebmol]

This is exactly the kind of software I learned to hate. As a student without my own computer, the only internet access I could get was through the computers in the library. Curiously enough, every so often all my personalized settings and the files I saved to the hard disk would just disappear.

I got rather pissed when I found out what was going on. There's got to be better ways to deal with this kind of thing. It's a pain in the butt having to change the resolution and all kinds of IE settings everytime I log onto a new computer. I thought Win2k had roaming profiles?

Re:This software...

[Sgs-Cruz]

Oh yes, at our school board (Halton School Board in Ontario) we use software called Deep Freeze. Which worked great (people would download and install MSN, mIRC, Quake II, etc. and it would disappear next time the computer was turned on) until some of the computer-oriented kids used a miniscule (literally, asking a teacher that didn't know much about the system) to get the Deep Freeze password.

We then had every computer in the school getting installed with many games and chat programs every time the computer got turned on. Not only that, the password was changed so the teachers couldn't change it back.

My point is this: perfect physical security is nothing without dedication by the humans that have to use it.

Re:This software...

[sheetsda]

Many years ago my high school used a Fortres product (may or may not have been the one you're talking about but the idea sounds the same). It worked well enough for keeping the majority of average high school students out of trouble but the lab techs had no problem hacking through it. At one point there was an old system with Fortres on it which no one knew the password to, and so the lab techs were asked to take Fortres down so the machine could be updated and so forth. We succeeded in minutes, and consequently I've been skeptical of the usefulness of products like this one ever since.

Re:This software...

[epukinsk]

I don't know about XP, but I know it's pretty much impossible to try to lock down a Win2K workstation with file system level permissions. Applications simply aren't designed to work without write access to their C:\Program Files\FooApp folder.

You have to revert to registry hacks or security policy changes, which is a pain in the ass considering the same task is basically automatic on UNIX.

Erik

Re:This software...

[dramaley]

I have Fortres installed on the lab machines that i administer. It is only easy to break into if you have it set up insecurely. The default settings aren't terribly secure and there were a couple of articles in 2600 a few issues back that described how to break into it. My machines were not vulnerable however because i had gone through each setting and made the machine as secure as possible. User's can run programs that i want them to, but that is it.

Re:This software...

[kyz]

Of course, I'd just you a keyghost hardware keystroke logger, so it wouldn't really matter what your software setup was like.

I think ThinkGeek used to sell these babies for a little while, they probably realised they' have rather unethical uses. You might need to break your own locks if you've lost your key, but you certainly don't need to log your own keystrokes because you've forgotten your password.

Re:This software...

[bigberk]

I like the reset to clean state approach. I use public workstations at university (sure, I know it's not that secure) but I always reboot their Windows machines instead of just logging out.

I always advise my friends to do the same. Another thing I wish they could do is have the machine log-off after a timeout (instead of the screen saver). This would prevent forgetful people from staying logged in after leaving, which is a huge source of mischief.

Re:This software...

[allism]

We've been locking down XP boxes for use with custom medical software, and we have managed to lock the systems down to the point where you really can't even breathe on them. We lock down one system then use Ghost to create all the other systems.

A program that you might find helpful for managing your registry hacks is Winguides Tweak Manager. It offers a pretty simple way to turn on/off most registry hacks, and includes links to their website detailing exactly how to manually perform most of the hacks. I don't know if there is a version for W2K, though.

Re:This software...

[extra88]

Actually we've been pretty successful doing just that. We have a lab running Win2k that has its file system very locked down. We started with Microsoft's own security templates which basically gives the "Users" group Read & Execute permission only for the entire drive except their own profile directory and to *specific* files in the C:\winnt\ directory which any user account needs Write access to. To this we added a Deny Execute rule to the profile directory so they can Read/Write files but if they download a program, it won't run (our students don't have individual domain accounts so the lab machines auto-login with a generic account. It's harder to do Deny Execute if they have their own logins).

The user account uses a mandatory roaming profile so when it logs out, all changes to the profile directory are wiped and thanks to WinExit screensaver, the account logs out (force quitting applications) after 30 min. of inactivity (then the auto-login logs it back in). To protect their documents from accidents, the default save location is a "docs" folder outside the profile directory to which they have read/write access but also Deny Execute. That folder is kept clean by a nightly script.

I find figuring out the registry permisions harder than file permissions. Some programs use the Registry in weird ways. RegMon helps figure it out and FileMon helps with the files. What would really help would be if more software companies would write less shitty software and software installers. User settings can go in their profile directory and registry, user documents can go where ever the user decides. Application settings that aren't per user can go in HKLM\Software\Foo\ and then you can choose which users have write permission there.

It would be a lot easier if we were running Active Directory so we could have global Group Policies. As it is, I had to do it all locally on one machine then Ghost the rest.

Re:This software...

[Anonymous Coward]

Yeah, lets see that work against the current USB keyboards. Oh wait, I forgot, PCs still use 20 year old serial port technology. Oh well, the PC industry is just shooting themselves in the foot these ways.

Re:This software...

[racerx509]

You are definately right. I recall back in my High School days, there were a fleet of shiny new 600mhz dell machines put in, loaded with Fortres 4.0 on them. The previous machines ran 3.0, which was no challenge to disble, but 4.0 was not. To make matters worse, one of the sys admins who set it up used draconian measures which made computer usage for both teachers and students laborious to say the least.

Fortres 4.0 is not an easy beast to kill, but there was at the time when I was playing with it, an active community devoted to hacking it. There was sourcecode to a program written in Visual Basic, which is present in many computer labs to rip the Appmgr.set and Fortres.F4 file from memory. Those two files needed to be copied in order to hack it. After that, being handy with softice and you could decrypt the password from those two files. At the time, I was not, so I had a friend do it for me.

After having the fortres password, I did what any self-respecting high school geek would do. Play games! I installed emulators and roms all over the network, and used it as a personal arcade for a while. I kept in good graces with my teachers by using my powers for good by installing printers, and chaning resolutions and the like to accomodate them, when the real sysadmin was busy. I installed a few text logging programs on some high traffic machiens, and did glean some useful passwords, but did not use them out of fear.

Eventually, I was caught, but after helping the teachers out so much, they came to my aid. I was banned from the computer network for the rest of the year and my games deleted, but I avoided prosecution.

Re:This software...

[Anonymous Coward]

Deep Freeze...HAHAHA yeah you can open the deepfreeze program, open the saved settings file, and boom, the admins password in clear text. God did i ever have fun in my typing clas with that.

Re:This software...

[Anonymous Coward]

lol! Depp freeze!
that thing is so easy to disable, u just hafta boot up with ur own boot disk and rename the deepfreeze dll...

u can even make a program that fakes the icon in the system tray if u want

This reminds me of a PM I had one time

[RodeoBoy]

He was part of a Internet backing project for a large European bank. This bank was one of the first to offer services over the Internet. He always used cash and did all of his banking with a real live teller. He didn't have any credit or banking cards. I think that says a lot.

I have been doing Internet based development exclusively for four plus years. I still do not use Internet banking. People are so willing to jump to use any service that makes thing easy without thinking about any potential consequences.

I think I have to find a new job, because I think people are too stupid to use computers. Sad but true.

Re:This reminds me of a PM I had one time

[Anonymous Coward]

I bet you don't drive either. Surely your life is worth more than your credit information?

You don't have to put your hand in the garbage disposal for kicks anymore eh? Just buy something from Amazon, huh?

You must live in a bubble-wrapped house too. There are "potential consequences" for EVERY action and/or inaction, no matter how big or small. I can see validity in your argument ONLY if these problems were rampant, but they are not.

You also must support the Patriot Act. The "potential consequences" of freedom is just TOOOO damned great.

Re:This reminds me of a PM I had one time

[Anonymous Coward]

What are you talking about? What is PM? Price Mistake, Private Message? BTW, if someone takes money out of my account because the bank left a hole in their online banking site, guess who pays me back the money for their mistake? The bank! Can you find me evidence of a bank where ATM transactions were being executed incorrectly but they refused to reimburse their clients? I am afraid your PM (?) probably also though the government was sending messages into his brain on special radio waves.

Re:This reminds me of a PM I had one time

[RodeoBoy]

Were did I say anything about my credit cards?

Yes there are potential consequences with every action, but Internet banking doesn't solve any problems for me so why use it.

The rest of your post didn't make any sense so I'll stop now.

Re:This reminds me of a PM I had one time

[Foogle]

Maybe it was his Prime Minister. Or his Pizza Man. Wait no, it was his Personal Masseuse. No, no, his Prime Meridian. Pre Menstrual?

No?

Does anyone? know what a PM is supposed to be?

Re:This reminds me of a PM I had one time

[Julian352]

My guess is that it is a "Project Manager" rather tha Price mistake. ;)

As far as return of money. Yes, the bank will return your money once they admit that the mistake was in their software rather than yours. Some online banks have a policy of not being responsible for your security problems. That means that if your PC was hacked or your password stolen they are not responsible for the transactions. (I don't know if it'll hold in a court, but that's their official policy) Another problem is that if most of your money was in that account and was stolen, it will take months (I've heard of people who were waiting 3 months for funds returned from stolen ATM/check card) for them to re-imburse the funds. That means months of not having any money to pay for bills.

So yes, there is more risk with online bank than with a normal bank, but not extremely high risk for most people.

Re:This reminds me of a PM I had one time

[Anonymous Coward]

Since he is talking about software development I think it is a safe bet that he is refering to a Project Manager. New to Slashdot? Are you a little slow?

Re:This reminds me of a PM I had one time

[roie_m]

Project manager, I think.

Re:This reminds me of a PM I had one time

[JaredOfEuropa]

Hmm... that PM (I am guessing: project manager) sounds like a paranoid luddite to me... which isn't to say that one should not be careful. But the few stories one hears of people having their money stolen because of credit card or Internet banking fraud dwindle beside the millions upon millions of happy users of these services. And the cases in which the defrauded users haven't had their money restored to them in the end are even fewer.

Cash has its drawbacks too, and it's not just the waiting in line to withdraw or deposit money. Ever gotten a counterfit bill as payment, or as change in a supermarket or bar? Good luck convincing anyone that they were the ones to hand you that particular bill.

Re:This reminds me of a PM I had one time

[bigmouth_strikes]

> I think I have to find a new job, because I think people are too stupid to use computers. Sad but true.

The problem isn't stupid people, it's that supposedly smart programmers can't write good enough software so that everyone can use it.

Re:This reminds me of a PM I had one time

[gl4ss]

it solves the problem of not having to walk to the bank and either wait to get to the teller or use some bank card operated bill paying machine(which, by the way, are suspectible for card data scanning by 3rd parties, there was a case here not too long ago that some crooks installed a fake panel with keylogger to the keypad+card scanner to an atm machine, so they gained access to hefty amount of card data + matching pin codes. also it isn't that uncommon to lose your card by theft just after somebody sniped your pin code while you typed it, of course if you're quick you can cancel the card before they can suck you dry.).

internet banking is for some people the only reason to use internet. especially in remote areas your options pretty much are by phone or by post besides internet. internet banking is safe enough with disposable keys and if you trust your bank(which you obviously must do to use them at all.)

Re:This reminds me of a PM I had one time

[Anonymous Coward]

I've been using internet banking for years now and never had a problem.

Though I would never log in from a public terminal. I wont even log into my email account from school.

Re:This reminds me of a PM I had one time

[HeghmoH]

Not to mention that cash is a lot easier to steal than secured finances on some bank's web site. My wallet was stolen once, and I lost two hundred bucks in cash, but they never got anything from the cards in there, even though they got two bank cards and one credit card. Carrying large amounts of cash makes me nervous, but using 128-bit encryption to look at my checking account doesn't bug me much.

Re:Actually...

[Glonoinha]

Actually I was with the guy right up until he turned to the dark side and used the information to steal. I think the penalty for 'liberation of information' or white hat hacking should be pretty thin, but the minute someone steps over the line and does something bad with that information we lop off a hand (like they do in ?Muslim countries for stealing?) I figure that losing a hand is a pretty good way to keep someone from becoming a repeat offender (pretty difficult to work a computer if you lose both hands) and THAT will serve as a pretty strong warning to others.

Two thousand dollars will buy you a lot of McBurgers, but won't buy you another hand (even in Chiba City.)

Cut and paste your passwords

[yog]

Never type a password on a public computer. Instead, cut and paste the characters from the screen using the mouse only. Of course, the problem is you have to have every letter and character displayed somewhere. You could browse to a site like this and paste character by character. It's slow but better than having your identity stolen.

Re:Cut and paste your passwords

[McCart42]

A good way to do this is to use software like PINs (which is open source, by the way), which stores your passwords using a 448-bit Blowfish algorithm, then lets you access them with a single password. Then, bring a password disk along with you so when you're on a public computer you can just insert it and copy your passwords from this program. Very simple and also prevents forgotten passwords.

Re:Cut and paste your passwords

[Gudlyf]

You can do this using FPM.

Re:Cut and paste your passwords

[Coolfish]

most keystroke monitors also store everything you copy to the "clipboard" in Windows.

thank you, try again.

Re:Cut and paste your passwords

[Anonymous Coward]

So copy and paste a few letters/numbers elsewhere in between pasting the right ones into the password form. "A few" can be increased for increased security. :)

Re:Cut and paste your passwords

[Student_Tech]

How about just type 1 letter of your password, jump to another window and type stuff, go back type the next letter, go to a window and type stuff, ect. That way your password is there but there is gibberish between each of the letters.

Re:Cut and paste your passwords

[Anonymous Coward]

pnitorarsnissiwtrostoeysrthindop

What's my password? Cutting and pasting extra crap helps in obfuscating it, even though I do think it's a stupid idea.

Re:Cut and paste your passwords

[Cyno01]

Some password textfields have cut copy and paste disabled on them.

Re:Cut and paste your passwords

[waytoomuchcoffee]

For the really paranoid, there are apps out there than take screen shots every time you perform an action (like click a mouse, or cut and paste).

Re:Cut and paste your passwords

[saunder3]

I was about to suggest my favorite on-screen keyboard until I remembered that installing programs on public computers started this whole thing.

Re:Cut and paste your passwords

[Anonymous Coward]

most keystroke monitors also store everything you copy to the "clipboard" in Windows

Nope. Most don't. Some do. So does the clipboard technique afford you slightly more security over the long run? You bet.

Unless you can suggest a better technique for password entry on an unsecured machine, you should encourage people to do what they can, even if it's a small improvement.

Re:Cut and paste your passwords

[quacking duck]

How about typing part of the password, highlight, type to erase/type new part of the password. Repeat. eg my password is "easyp@ss" I'd type "@ss", click to beginning, type a string of garbage characters (eg "blank234"), highlight the garbage characters, type "yp", click to beginning again, type more garbage characters, select again, type "eas". As long as the keystroke recorder doesn't record where exactly you clicked in the text field, and you just overwrote the text rather than hit the delete key, you should be fairly safe. The password is SOMEWHERE among the characters you typed, but they'll have fun figuring it out from the log.

Re:Cut and paste your passwords

[Anonymous Coward]

Nope, 'parsnip' was the answer. I honestly expected more guessers. *shurg* What a bunch of sissies.

Re:Cut and paste your passwords

[waytoomuchcoffee]

The article stated:

"Richard Smith, a Massachusetts-based Internet security consultant, said the software in question is typically used by jealous husbands or wives to spy on their spouses."

Doesn't really sound like the computers were using a *nix OS, which FPM requires.

Re:Cut and paste your passwords

[Anonymous Coward]

MWUAWAHAHA by cleverly waiting we socially engineered you in to revealing your password!

All your base are belong to us!!!

Re:Cut and paste your passwords

[Anonymous Coward]

Hello, support? I need to run a browser before I log in so noone st341z my p455w0rd. How do I do this?

Re:Cut and paste your passwords

[DickBreath]

I've thought a lot about having to log in via. an untrusted system.

Suppose I want to, say, SSH into MY computer from an untrusted location. (i.e. even an SSH applet in someone else's browser, still might have a keystroke monitor.)

First make the assumption that anything you see, click or type is monitored and possibly recorded.

My conclusion? Use one-time passwords. Or Challenge-Response. Pull out Voyage Of the Dawn Treader, page 37, each line is the next password. Take the third word of the line, plus however many additional words make up 10 characters, and that is the password -- this time.

Three passwords are used each time. You supply one. The system gives you back the next password, just so that you know you are talking to your system. And when you log out, the system gives you back the next password, just so that you know you successfully logged out.

Have a magic short e-mail token that can be sent to a magic e-mail address on your system to immediately abort all of your current remote login sessions. Have this as a shortcut on your cell phone. Within a couple minutes you could cut off all remote logins given the hypothetical need.

Of course, I tend to assume that when I use a public or other web browser, such as a public terminal in the Epcot Innoventions area, that there isn't somebody just wanting to hijack my remote login. (And with the sophisticated necessary preperation.) But it's nice to feel safe.

When I was at BC....

[Anonymous Coward]

When I was at BC(around 6 years ago) I was a CS and Econ major. BC is not a big CS school. We had this computer lab of about 12 DECstations.

My first experience with the internet and Mosaic(ahh the days)

Anyways, at one point when I would log onto any of the machines my account would completely hang. I would have to shutdown the machine. I quickly noticed when I logged on and my machine hung, also ALL the other DECstations would freeze!!!! LOL

The admin was completely puzzled. I had no clue I was a fledgling CS major. Anyways he had to delete my account and create a new one. Ahhhh the power I had to stop all the workstations *evil laugh* But I never took advantage of that.

All my friends thought it was pretty funny...

Re:When I was at BC....

[Anonymous Coward]

But sadly for you the admins didn't.

Re:When I was at BC....

[Anonymous Coward]

The joys of Token Ring

wonderful!

[tekunokurato]

Haha! This is much better than typing- now you don't have to worry about keystroke recorders, but everyone around you can see what your password is!

Re:wonderful!

[Anonymous Coward]

yep! you can't get any more inconspicuous than a BRIGHT MAGENTA page with "Copy and paste into password forms:" in a 24 size bold font!

Re:wonderful!

[waytoomuchcoffee]

I wish I had mod points left.

Re:wonderful!

[shaldannon]

You should seriously submit that for inclusion in the fortune computer database.

Re:wonderful!

[tekunokurato]

Why the FUCK did this get modded up and mine didn't??? I was being sarcastic, you jackass moderators!

Re:Actually...

[Anonymous Coward]

How about College Campus Computers?

"gleamed"

[Hubert_Shrump]

As in "he made it gleam by scrubbing it."

"gleaned"
As in "she gleaned through the dupes, only to find improper usage of 'gleamed'."

"frustration"

If you're going to use a big word...

[Anonymous Coward]

Use the right one.

Something shiny gleams.

Something taken is gleaned.

Real article title..

[Chuck Bucket]

Arrested for Misspelling Compus on Slashdot

CB

The truly scary thing ...

[dougmc]

The truly scary thing about all of this is this :

You only need to install your sniffers on a few boxes to get plenty of good credit card numbers and passwords and such. And if it's installed on only a few boxes, it would (unless they were specifically looking for this) be very hard to detect if done correctly.

And then if you're careful about the credit cards that you use (i.e. use only one or two, or only those that have bought stuff from a given site, etc.) they won't even suspect that people are sniffing at this one site. (If you use every credit card you find, the credit card companies will figure it out pretty quick by finding out what's in common with all the cards in question.)

In short, for every guy who's caught, there's probably dozens of guys who aren't caught.

Be afraid. Or, more importantly, be careful.

I Am A User, What Can I Do For Protection?

[realperseus]

Say for example I am a user on a public machine that I suspect has keystroke monitoring software. What can I do, load onto it, download, to protect myself and detect and/or remove these things? One can always go to site to check a machine for viruses and such, but what can be done/loaded to protect against keystroke monitoring?

Re:I Am A User, What Can I Do For Protection?

[Atrahasis]

Go to a site which has a java keyboard, and use that for any sensitive info.

Re:I Am A User, What Can I Do For Protection?

[Anonymous Coward]

Please explain how this works and defeeats keyboard monitoring (and cut/paste buffer logging.) Thank you. Google doesnt' seem to have any good pointers.

Re:I Am A User, What Can I Do For Protection?

[Erastus]

How about some scheme where you enter characters as well as bogus characters and, using the mouse, position the cursor at various points and use the delete button to remove only the bogus characters. If you did it involved enough -wouldn't that be a way to get around it?

Crime is Crime not computer crime

[Dragon218]

The title to this article is not really accurate in this case. The person who was arrested stole $2000. He was arrested for that (or should have been). The keylogging software in this case was just the means to commit the crime. It shouldn't be illegal to install keylogging software (unless he's breaking the user agreement by installing software on that computer, etc.). To say he was "arrested for installing keylogging software" to represent theft could be compared to saying a murderer was "arrested for buying a gun and ammo."

Using a computer to commit a crime is no different than just commiting the crime. There should be no elevated charge just because he used a computer and software instead of a forged check or stolen credit card.

Re:Crime is Crime not computer crime

[Anonymous Coward]

I don't know how you could compare using keylogging software on systems you don't own to buying a firearm and ammunition.

It might be a better comparison to say he went in his neighbor's backyard and shot some ducks with that gun.

Otherwise I would agree with you. If you commit a crime, you've committed a crime. If you kill someone with a gun, I don't think you should get a harsher penalty than if you killed them with a knife.

Now I can move off topic and make the point that I think who you are should depend how harsh of a penalty you get. I think law enforcement officers and politicians, and others in governmental positions should get harsher penalties for breaking the law, especially if they use the advantage of their position to commit the crime.

So ya, this guys a high-tech crimminal. If theres a way to do something, someone's going to do it. The answer isn't outlawing the sale, possession, or distribution of keyloggers. The answer is a combination of personal responsibilty of those that use public computers (hell, I'd never input any personal information into a computer I didn't own or know very well), higher responsibility of the system's administrators (maybe they need to higher a few more, or pay them a little more), and make sure that the crimminal commiting the act actually gets punished for it. Just throwing the people in jail for the rest of their life because they are "hackers" aint helping anyone. Its a far, far, bigger waste of tax payer money than a few thousand bucks (no wonder why they used to just hang people for stealing.) Make the crime not worth their while by making it more profitable for them to work at McDonalds.

Re:Crime is Crime not computer crime

[havardi]

You would think so... but that's not the case. In some states, using a computer to access any private information is a felony. Also, using a computer to alarm someone is also a felony. Not harrassment; Computer Tampering. Our justice system is as ignorrant of computers as your grandma... and just as scared.

Re:Crime is Crime not computer crime

[Cranky_92109]

It shouldn't be illegal to install keylogging software

It absolutely should be and is illegal to install keylogging software on systems that do not belong to you. As for a more apt handgun analogy, it is illegal to carry a concealed weapon without a permit. So the charges should be for both, illegal use of computer systems (wiretapping, whatever) and theft.

Re:Crime is Crime not computer crime

[Commerco]

I completely disagree because I think your analogy is flawed. The action of placing keystroke snoop software on a system absolutely does not even approach "arrested for buying a gun and ammo."

If one were to create an analogy (albeit a poor one), it would be more like; "he broke into the gun store and stole guns and ammo with which he may or may not have committed murder". A world of difference.

It is the act of breaking into or obtaining someone's private data without their consent or knowledge - *THAT* really is the "crime".

Theft is theft, whether it is a lowly pickpocket or lowly data pickpocket.

Re:Crime is Crime not computer crime

[bookroach]

Installing key logging tools on public terminals with criminal intentions is much different than purchasing or being in possession of key logging equipment or software. This if very different than just purchasing a gun unless it is proven the gun was purchased with the direct intention of being used in a crime.

Re:Crime is Crime not computer crime

[Razzak]

I'm not sure what law this breaks, but it must break some kind of privacy law. You have the right to own a gun. You don't have the right to monitor other people's sensitive information without informing them.

Talk about timely...

[Big Sean O]

I just finished teaching a 2-day class in a computer lab that used Clean Slate. It works as advertised.

The biggest problem was having to reinstall the program I was teaching the second day.

Usually I make a habit of NOT logging onto websites when I'm using a strange computer. I did check one of my e-mail accounts while I was there. I think I'd better change my password now... :-O

suspended?

[myrashka]

Boudreau, who faces up to 20 years in prison if convicted on all charges, was not immediately available for comment. Boston College said it suspended Boudreau, 21, last year once it learned of his scheme. Suspended? Do they think he'll continue his education in 20 years? How is it he's been suspended for a year and only now their just indicting him....gotta love the speed of justice. I spose they can't expell him until he's convicted (innocent till proven guilty and all)... So, do you think he had all the keystroke logs sent to his main email acct?

Re:suspended?

[Anonymous Coward]

Suspended? Do they think he'll continue his education in 20 years?

Possibly, they think he might be innocent, given that he has not yet been proven guilty.

Clean Slate...

[rebelcool]

i've seen this on a number of machines. I believe as soon as you logoff it reverts to the 'default' state.

While this might be annoying to some, in general, its a good thing on public computers. Besides undoing any software installs a user might've tried, it also removes old cookies and temp files that might contain someone's personal info.

Most public uni. computers ive seen all have zip drives. If you want to download and save something, I suggest putting this to use. It is, after all, a public computer.

Re:This software... -- is worse than useless

[plsuh]

This is still not adequate -- and is (in some ways) worse than nothing. Having managed a lab of student computers back when I was a grad student, often times people will simply sit down at an otherwise unused computer and start typing in URL's. If the attacker installs the software (not requiring a reboot) on a machine and walks away, the next user and any other users who use it without a reboot will still be vulnerable. The keystrokes can be recorded by sending them to an SMTP relay or open FTP server.

This is worse than nothing because if the machine is rebooted then you have just lost any chance at doing forensics on the attack.

There are far better solutions available. First, do NOT allow user software installations -- this should be a part of the TOS for such a lab. This in turn allows you to lock down the machines very tightly. Downloads can still be allowed to a user's network account or floppy or zip disk or USB keychain device.

In a managed environment such as a university, require students to log in to computers with campus-wide accounts. Win2k and XP, Mac OS X, and most unices support Kerberos logins, which are becoming widespread on campuses. This gives students their own home dirs automatically, with saved prefs, etc. It also allows much easier forensics on attacks as well. If you want to allow public access, post a public login to an account that has zero privileges on the wall of the lab.

By going this route, you can then use netbooted machines without internal hard disks, vastly simplifying maintenance and system administration. Netbooting is not always easy to set up, but the payoff is well worth it in such lab environments.

--Paul

Don't quit your day job

[Abductor]

He had access to all that information and the best he could do was get caught stealing 2000 bucks? Bwaaaahhh hahahaha...

Re:Don't quit your day job

[Zontar The Mindless]

Ever consider the possibility that he got snagged for only 2 grand but actually got away with more?

Re:Don't quit your day job

[dotgain]

...or the possibility that he had /some/ conscience, and wasn't actually in it for pecuniary (sp?) gain?

Just because he stole $2000 doesn't mean he intended
to go on to steal more.

Re:Actually...

[palindrome]

Yes, I agree.
Maybe we should all have spyware installed on our machines so that all of our information can be "liberated".

He would have gotten away with it too

[RomikQ]

If it wasn't for those meddling kids!

This indicates a few things

[RealBeanDip]

1. People (most people, the majority of people) are completely clueless when it comes to security. The see that their password isn't displayed, so therefore it must be safe. Public computer? ... not a concept or an issue to them.

Question: Is this their fault? IMO, no it isn't. The visual indications they see indicate they are indeed using some kind of security. The problem here is software manufactuers (not just M) do not have most users best interests at heart when it comes to security.

2. A system that allows key monitoring software to be installed so easily SHOULD NOT be sold for public use! Not only are the software makers at fault, but so is whomever decided to use such an unsecure system in a public area. But whoever that is, is probably fairly clueless when it comes to security too.

This will continue indefinitely until 1 of 2 things happen;

1. Someone comes out with a dumbed down computing device that uses Windows (sorry, but that's a reality), is cheap, and requires little to no administration (or little enough that breaking the security by a clueless admin will be impossible).

- or -

2. People get a clue about security... not gonna happen.

In fact, I don't see either of the two happening, so IMO this kind of stuff will continue well into the future.

it is about time you get rid of the typo

[Edmund Blackadder]

It is in the title and looks really distracting.

Re:Actually...

[anon*127.0.0.1]

Absolutely. I think I'll build a few bombs in my garage, maybe brew up some anthrax or smallpox virus. Hey, as long as I don't do anything with them, the penalty shouldnt' be too severe... right?

Where do I go to get my white hat?

Public access banking? - Idiots

[nurb432]

No one but an idiot would 'trust' a public terminal for anything confidential anyway.

Even if it wasn't 'cracked', do you know whom the admins are? Or who they work for..

Its just a big risk to trust ANYTHING public these days..

Re:Public access banking? - Idiots

[Anonymous Coward]

My online bank uses one time passwords.

Re:Public access banking? - Idiots

[Anonymous Coward]

Have you ever used an ATM? If so, then you just violated your own rule.

Re:Actually...

[Anonymous Coward]

Sounds fine to me, but just be careful you don't harm anybody with those. Once you do, then you deserve to be punished.

Food for thought:

[Hubert_Shrump]

If it's a x86 box (does any other manufacturer use the PS/2 keyboard cord?), all you need is one of these babies. That'll catch the BIOS password (when/if it gets typed in) and all.

Ouch.

Of course, to do it right you'd probably need to power-cycle the machine (hate to fry the mobo while doing this...). Maybe try to get one right next to yours -- bump the power cord out of it...

But we're just talking here, aren't we friend?

Re:Food for thought:

[jmauro]

You can lock access to the bios without preventing the computer from booting. And one can have a different password for booting and for changine the bios options. I doubt you'd be able to insert the device and get someone then editing the bios password to change options in any case.

Re:Food for thought:

[Stonent1]

does any other manufacturer use the PS/2 keyboard cord?

SGI does.

Re:Food for thought:

[Anonymous Coward]

So I guess a USB keyboard and a BIOS password and no floppy drive in the machine is a good idea...?

Re:Food for thought:

[kasperd]

does any other manufacturer use the PS/2 keyboard cord?

AFAIK it is possible to use PS/2 keyboards on some Amiga models. And our NCD boxes (X-terminals) also use PS/2 keyboard and mouse. One of our happens to have a PS/2 keyboard from SGI, though I don't know if that one is identical to the keyboards connected to the SGI. I have noticed one functional difference on the keybards connected to the SGI though they look exactly like a standard PC keyboard. The software can see when the Pause/Break key is released, normally a PS/2 keyboard sends the key release code for that key already when it is being pressed.

Re:What I find amazing:Office Space

[Anonymous Coward]

Maybe he was pulling an office space and actually did it right haha? (No decimal errors @ him) ;]
But on a serious note, yeah he really is a moron. What a couple friends of mine did at a school which will remain anonymous is it connected to a master server where the logs were gnugp/pgp (duno which) encrypted then saved. and, if he was caught, there was an abort mechanism which automatically pgp wiped the hard drive a few times and trashed the mbr. they never actually got around to installing it though, but it's what i would do if i were to install keyloggers on a private facility.

Uh...wrong

[giminy]

I can pretty easily write a program for unix that does this:

Makes the screen black, and displays a "Welcome to Athena" sign on screen that looks just like the real one. It takes the username and password, and invokes su to run a shell/window manager as the user. In the meanwhile it logs their username/password to a file in my directory.

I guess it depends if su is installed on Athena (IANAMITS I Am Not An MIT Student), but probably it is. If not, you can just put a hardware keystroke recorder on the computer.

Unix does not a secure system make.

Re:Uh...wrong

[Minna Kirai]

I guess it depends if su is installed

Even if its not, you can still collect passwords, just more slowly. If it can't su, the trickster software can just display an "authentication failed" message and quit to the real login screen. The victim just assumes she mistyped on the first try, and the attacker has a single new password to play with.

Tricks like this is why Microsoft added the "Press Control+Alt+Delete to Log In" feature. (At the DoD's behest)

Supposedly, it would be impossible for any user-level program to trap that keystroke, so you always can be sure you're seeing the real OS login screen. (Of course, given how easy it is to compromise the OS itself, this protection means little).

High School

[Anonymous Coward]

Man... that brings back memories. In my junior (or maybe sophomore) year of high school, I discovered the wonders of key-stroke loggers. See, the teacher had a shared folder on one of the computers in the lab, and it was required that students access it. But, she changed the password every single week, and usually she was busy doing something, and wouldn't give you the password.

So I led the students to install keystroke loggers on all of the computers, and it was quite fun for a while.

I never got caught for that... but I did get caught for something much lesser the next year when Novell was installed on all of the machines.

See, Novell has a nice feature called Novell Messaging. By default, there was no way to reach it... but if you create a shortcut to a Novell NetBIOS share (like //server_name/ ), you can right-click on it and tada: Novell Messaging. It will list every user who is currently online. And allow messages to pop up on their screens.

When I discovered this (on my own... the class was getting boring), I told everyone. But the Network Administrator for our school district wasn't that apt, she had files in the server directory that student accounts could delete (I just checked the permissions, I didn't actually delete anything). Anyway, I got banned from the computers for a couple weeks, blah blah blah.

Info-gleaming

[nakaduct]

He then stole $2000 with the information he gleamed.

Radical, dude! Did he also Gleam the Cube, to get even by risking it all?

P.S.

Exaggeration

[KIondike]

The claims of stealing $2000 and other crimes are exaggerated. The story reported at CNet:

According to the attorney general's office, Boudreau began to install key-logging software around April 2002 and used intercepted information to add money to a stored-value card used in the campus dining and bookstore system. Boudreau is not, however, accused of misusing credit card numbers or profiting from selling any private information he allegedly gleaned.
A person at Boston College with knowledge of the situation said the attorney general's office exaggerated Boudreau's accomplishments in its press release, in an attempt to tout this prosecution as a high-visibility test case. "I feel bad for this kid," the person said. "He's not the appropriate test case. He's feeling bad. He has all these issues. He's been depressed."

Not that I feel bad for him for being depressed or anything, but he's being viewed as a real criminal who stole from hundreds where all he really did was mess around on a computer.

Caution for whom?

[crashnbur]

In what may serve as a cautionary tale for people who use computers in public areas...

Given the headline associated with the story and this line, I couldn't tell whether sympathies lay with the ordinary Joes and Janes who may suffer the adverse effects of partial "identity theft", or with the hackers whose abilities are likely to be legislated against.

My opinion: in a "free" country, if the United States is actually supposed to be free, then we should be "free" to install spyware anytime we would like on our own computers (i.e., school administrators and internet cafe owners should be allowed to install keystroke monitoring software on their own systems) as long as they do not use the information maliciously. On the other hand, there are ethical issues when there is no warning of installation of said software. And, again, when data gathered by such measures are used for purposes other than network security -- such as to violate the security of an individual without warrant for any reason -- foul play is afoot and repercussions should be harsh.

Hardware based keylogger from ThinkGeek.com!

[Dexheimer]

Key Katcher at ThinkGeek.com. There is much talk about blocking keylogging software in the first place, but what about something like this?

This is a device that can be connected to a keyboard to record all keystrokes. It has a changeable password, keyword search, enable/disable option, and stores URLs. Records more than 65,000 keystrokes and does not require any software. Monitor unauthorized access to your computer or your network. Use it to troubleshoot or make fixes by tracing back through a users command sequence.
Key Katcher plugs in between your keyboard and your computer. A microcontroller interprets the data, and stores information in the non-volatile memory (which retains the information even when there is a loss of power.) This means that the Key Katcher device can be unplugged, and the information will not be lost. Key Katcher plugs in between your keyboard and your computer. A microcontroller interprets the data, and stores information in the non-volatile memory (which retains the information even when there is a loss of power.) This means that the Key Katcher device can be unplugged, and the information will not be lost.
To access the recorded data, you simply type your password in a text editor and the Key Katcher comes to life. A menu is displayed with options to erase data, view data, search data for keywords, change password, or disable the device.

Re:Hardware based keylogger from ThinkGeek.com!

[Anonymous Coward]

There is much talk about blocking keylogging software in the first place, but what about something like this?

Hmm good idea, place keylogger in public terminal, come back at the end of the day and retrieve. I'd be very surprised if no one is doing this.

Re:Hardware based keylogger from ThinkGeek.com!

[andfarm]

Note to self: whenever logging into an untrusted machine, check along the keyboard cable to computer. If you see anything strange, unplug it and crush it under leg of handy chair.Crunch. Oops, was that your keylogger?

Seriously, devices like these should be illegal. There's really no legitimate purpose for them -- no more than for those X10 spycams. (No, "maintenance and troubleshooting" isn't a real purpose -- most users don't enter a "command sequence" anyway, so that's a moot point.)

Re:Hardware based keylogger from ThinkGeek.com!

[HeghmoH]

Yes, God forbid anything without a legitimate purpose should be freely available on the open market!

Re:Hardware based keylogger from ThinkGeek.com!

[alphaseven]

If you see anything strange, unplug it and crush it under leg of handy chair.Crunch. Oops, was that your keylogger?

Or the poor little PS/2 adaptor.

Some keyloggers (keykatcher?) are shaped like PS/2 adaptors, can you tell the difference?

Re:Hardware based keylogger from ThinkGeek.com!

[xombo]

But they do have a legit use, the thinkgeek description states:

Monitor unauthorized access to your computer or your network. Use it to troubleshoot or make fixes by tracing back through a users command sequence.

I want to see everything anyone types into MY uberleet mandrakelinux box.

Re:Hardware based keylogger from ThinkGeek.com!

[andfarm]

According to a few sources and AFAIK, telephone wiretapping devices are illegal (to use?) in the USA. Is there any reason keylogging hardware -- or software! -- should be any different?

Re:Hardware based keylogger from ThinkGeek.com!

[andfarm]

PS/2 adaptors usually go on mice, don't they? I've never seen an adaptor for a keyboard before.

Besides, PS/2 to PS/2 adaptors tend to be rather rare.

Re:Hardware based keylogger from ThinkGeek.com!

[nexthec]

I've seen all sorts of people that have "wire Tapping devices" usually they variety refferred to as "beige boxes" all so known as butt-sets, a critical tool if you do any work on telecom stuff at all, or utility, or residential, or comercial info tech/sec etc. Besides in several states, you can tap your own phone line as long as 1 of the two pareties know its there, hell Lawyers will tell the other party then procede to record the information using something similar to a wire tapp (just not concealed, plugged into the line in plain site). No devices like that sohould not be illeragal for several reasons.

Re:Hardware based keylogger from ThinkGeek.com!

[Anonymous Coward]

There was a time long ago, in the age of the AT motherboard, when keyboard plugs were thrice as big as they are now. Though the keyboards were largely indestructable, they were sometimes so caked with Cheeto dust that they were replaced with puny "modern" keyboards. In such cases, an adaptor was required.

That's why...

[ziggy_zero]

...you should use a hardware keystroke logger for stuff like this, like the KEYKatcher. Those things are undetectable...I mean who ever looks at the back of a public computer to see if there's a little adapter on the end of your keyboard??

Stupid thief...

[supabeast!]

This one reminds me of those Ann Landers "Stupid Thief" stories. What kind of idiot tries to steal from people using a college network? Students are broke, and most of the professors probably are not doing well either.

Maybe the next guy to try this will get a clue and do it at a law firm, so that he makes enough money to leave the country before getting caught!

The money had to come from somewhere..

[MadAnthony02]

The article doesn't say how he used information from the logging to add value to the cards, but I would guess he either a)found a way to transfer it from someone else's account (either their stored valued account or a bank account linked to it) or b)he found a way to add money by finding some sort of backdoor or the like to increase the amount shown in the account without actually increasing the amount of cash.

Neither is victimless - in the first, he still stole money from students, in the second he stole money from the college. While he arguably could have done much more damage, he should't be commended for only stealing a little

TUE

[ruudn]

The Eindhoven University of Technology (tue.nl) reinstalled the entire operating system (win9x) of all public computers from an image every day at first boot. Also, any user could choose to do the same thing at any time. Just reboot, and choose to reinstall.
The systems were completely open, you could install anything you wanted, so I used to do it everytime, just to be sure I was working on a clean system.

This was about 5 years ago, since then, every student has his own laptop, so I guess the public computers are gone...

Ruud

Re:TUE

[LogicET]

What if the image was backdoored?

Re:TUE

[ruudn]

Some things you simply have to trust. If you can hack into the server, change an image and make sure it is not noticed, you would hardly need a keylogger anyway.

I'm pretty sure the admins had some elaborate security mechanisms in place to prevent tampering with the images, e.g. read-only media, cryptographic sums stored at a different server, etc.

I would almost trust those computers more than my own desktop at home.

No. This is worse than simple theft.

[Schlemphfer]

On top of the $2000 he stole, it appears he must have invaded the privacy of thousands of people. Scumbags who do this kind of stuff need to be made an example of. This is loathsome behavior, and I hope the judge throws the book at him.

Wrong section?

[Anonymous Coward]

Surely this should be in Your Rights Online? That's were all the stories about computer criminals getting caught go...

Which one ?

[LiteForce]

...and I thought the article was referring to the original Boston College!

I only mention this as I was a student at the above and silent password logging TSRs were rampant on their network.

Oh yeah, and their entire collection of staff/student mailboxes and the mailspool were made available via an anonymous read/write network share if you knew enough about Novell Netware to manually map a drive.

To clarify, Boston (in Massachusetts, United States) was named after Boston (in Lincolnshire, United Kingdom) - more information can be found here.

What did he steal?

[Gray]

No specifics on what he actually stole. Did he just card stuff? That's pretty dumb.

I remember logged into a shell from a public terinal CCC99 in Berlin and was all disappointed when nobody showed up to own my box by the time I'd got home to Canada.

Arrested for Planting Spyware on College Compus

[Anonymous Coward]

my question is:

What's a Compus? And why doesnt my college have one?

Re:Arrested for Planting Spyware on College Compus

[GQuon]

What's a Compus?

A computer campus.

And why doesnt my college have one?

It is backwards.

Now, how about Kazaa?

[Pig Hogger]

Now, how about indicting and convict Kazaa and those of the same ilk who pepper their users' computer with all sorts of spyware without explicitly warning them right upfront???

Re:Now, how about Kazaa?

[Anonymous Coward]

This guy stole $2000. How much money has Kazaa stolen from its users so far?

Temporary passwords

[JaredOfEuropa]

"The real thing to remember is to never, ever, ever use a public system. That is the most sure way to give up all privacy. Even if there isn't a 3rd party breaking into and modifying the public machines, the true administrator of the machine might have all sorts of logging software."

I feel quite safe doing my online banking in any dodgy Internet cafe. As with most online banking services, the bank's website sends a challenge which I key into a device that generates a response. This response is then used a a one-time password. (Actually, the chip on my bank card is inserted into the device and generates the response, only after keying in my PIN first). Our company web mail system and tunneling software use a similar system. I have no worries about my passwords being stolen, since I use them only once.

Of course, even with a challenge-response system you still have to be careful about theft of data that you retrieve.

Re:Temporary passwords

[JerkBoB]

Which bank do you use? I have used a couple of banks which offered online banking, and haven't seen that setup before.

Re:Temporary passwords

[JaredOfEuropa]

I use ABN Amro, a Dutch bank, but they offer retail banking services in a number of other countries as well. I'm not sure if they offer similar Internet banking there, though.

Re:Temporary passwords

[Bert64]

And theres still the possibility of a daemon running on the machine, which would allow the attacker to actively hijack your session after you have authenticated yourself.

Re:No. This is worse than simple theft.

[Anonymous Coward]

Yes, but then the sysadmins are allowed to do this everyday.. If people will use computers they must except the possibility of being monitored all the time.

You wouldnt jerk off in front of a public computer would you now.

uhhh...

[Hubert_Shrump]

but wouldn't a hardware logger make having to dick with the BIOS a moot point? I mean, we were going to mess with it so we could install it in software, right?

let's stay focussed, here -- on this... conceptual exercize.

Run that by me one more time...

[Kjella]

It shouldn't be illegal to install keylogging software (unless he's breaking the user agreement by installing software on that computer, etc.). To say he was "arrested for installing keylogging software" to represent theft could be compared to saying a murderer was "arrested for buying a gun and ammo."

Let's see now.
1) School AUP, contract law
2) Program EULA, contract law
3) Gathering access tokens like passwords, criminal law
4) Gathering confidential material (yes I've had classes where the raw case material was confidential, like interviews. I could be typing up that. Or writing a letter to my doctor), criminal law
5) Gathering personal info, privacy laws, anti-stalking laws
6) Planning to commit fraud (a crime even if he hadn't actually done it yet), criminal law

Give me a break, installing that software is a crime in itself. The fraud charge is just one more to add to the list. It's not purchasing the tool, it's putting that tools to illegal use. It's not legal for me to make keys for other people houses even if I haven't robbed the place yet. Or to swipe someones credit card, even if I haven't used it to get money yet. And for the immidiate discussion-stopper, it's not legal for terrorists to gather intelligence, even if they haven't blown up the target yet.

Kjella

Re:Run that by me one more time...

[Anonymous Coward]

Problem there. Akmed is on holiday? Or is he casing out the Golden Gate bridge for a missle strike?

Re:Run that by me one more time...

[Dun Malg]

Give me a break, installing that software is a crime in itself

Not necessarily. You're pulling arguments out of your ass, friend.

It's not legal for me to make keys for other people houses even if I haven't robbed the place yet

It's not illegal to make a key to someone else's house. In fact, your own house key (if it's a common brand such as Schlage[10^5 possible combinations] or Kwikset[6^5 combinations]) already fits the front door to someone else's house-- I guarantee it. Posession of a someone else's key may be incriminating evidence in the case of burglary, but it is not a crime in and of itself.

Or to swipe someones credit card...

Theft of property. No one can claim ownership of a password, so this analogy is flawed. Posession of a password is, at best, incriminating evidence.

And for the immidiate discussion-stopper, it's not legal for terrorists to gather intelligence, even if they haven't blown up the target yet

Gathering publicly available information is not illegal. Conspiracy to commit (crime X) may be illegal, and gathering/posessing intelligence in order to commit said crime may be incriminating evidence, but unless that information is classified secrets or the like, mere posession isn't against the law. Likewise, having a piece of paper with a list of userIDs and passwords isn't illegal either-- but if someone's been getting into those users' systems, boy will you look guilty!

In short, you don't seem to grasp the distinction between "incriminating evidence" and the crime itself.

Glad I use Knoppix

[Rysc]

This makes me glad I use Knoppix.

When I am forced to go to the local community college computers to do some homework, I bring along my trusty Knoppx CD. Pop it in, boot up, and poof. Instant security. Knoppix even grabs one of their local DHCP addrsses and gets online right away. Of course, I could still be monitored if they really want to do it, but the runo-of-the-mill key loggers would be thwarted, and that makes me feel much safer. The fact that it's an effective local log/cookie deleter doesn't hurt either.

They have a policy about using unauthorized software, but after careful reading I decided that its intent was to prevent system instability and whatnot by disallowing all software installs. They might still disallow me if someone in charge knew, but I don't care.

Re:Glad I use Knoppix

[SuperFrink]

Sure that will clear out software running on the operating system but what if the logger is in hardware? "hardware keystroke logger" at google

There are devices that you just plug in between the keyboard and the computer that will log every key you press. I know PS/2 loggers exist. I'm not sure about USB though.

You can even get keyboards with the logging device build inside the case where people are much less likely to see it.

Re:Glad I use Knoppix

[Rysc]

Like I said, if they're really keen on it I can still easily be monitored, but the chances of a random third party doing it are somewhat reduced.

Re:Glad I use Knoppix

[Anonymous Coward]

Of course I agree it's reduced and of course someone who admins the machines could put in enough work to monitor. What I wanted to point out is that keystrokes can easily be grabed in hardware (even by a third party).

I've though about how to truly be able to trust a connection and I'm not sure if it's possible to have trust that one can prove. I guess that's where "trust" comes in. In the end it's a human feeling.

Re:No. This is worse than simple theft.

[madcow_ucsb]

You wouldnt jerk off in front of a public computer would you now.

I dunno, my mom works at a library and always has stories about the weirdos who wander in and head straight for the porn...

Re:Actually...

[Elwood P Dowd]

I figure that losing a hand is a pretty good way to keep someone from becoming a repeat offender (pretty difficult to work a computer if you lose both hands) and THAT will serve as a pretty strong warning to others.

Whoops! It really looked like you in the security camera! I'm sorry, dude. Yeah, you're innocent. My bad. Here's a complimentary prosthetic hand.

I'm not sure if you were joking or not, but it's always important to consider the accuracy of our judicial system when penalties like that.

Deep Freeze?

[lpret]

Have any of you tried Deep Freeze? We run at my university and it works under the same premise of Clean Slate; however, I've found it to be faster to boot up. Also, I have yet to hear of some way around it -- it really does an amazing job.

Re:Deep Freeze?

[kwenda]

Yeah it works great when a user accidentally kicks the plug out of the floor and takes out the whole row of workstations. Once they're plugged back in, the auto-recover files are gone. That said... all the students have a network directory that they should be saving their own files in every few minutes, but you can't teach common sense.

Atleast he wasn't installing....

[GhettoFabulous]

http://www.gator.com Gator which also logs passwords, account numbers, login names....

gleamed?

[A_Non_Moose]

Shouldn't that be gleaned?

I though gleam was related to "shiney objects". (OOOoooh!)

{heh, and no, I'm not new here}
.

Old tech keylogging

[AndroidCat]

Back in the old days on the high school Teletype, we had a few successes capturing passwords by leaning on the paper tape punch on button. One time, someone spotted the moving tape after he'd logged in, stopped the tape, ripped it off, crumpled it and tossed the tape in the garbage. After he left the room, everyone dived for the garbage can. (A number of us could read paper tape manually.)

*ahem* but of course I haven't done that sort of thing in decades... ;^)

Criminal

[mu51c10rd]

Amazing, I see some posts that actually support this guy. As to most of the others, I agree that the Admins of public domains need to be mroe security conscious. However, we cannot fault the users of these computers. Most of the /.'ers are all in the IS/IT/(whatever it is called now) field and do not realize that the common public do not want to learn everything we know. In the same way I could care less all the ins and outs of, say, biology when all I want to do is plant something. The inner workings of chlorophyl is not something I particularly care about, I just want my plant to grow. In the same respect, a common user is not going to care about how computer security should work and whatnot, they just want to use this fancy cool-looking email to go to their friend/significant other/(whatever they call them these days). This guy is a criminal, stole information, and then may or may not have used i for personal gain, although it sounds like he did. The guy is at fault, not the users. Don't blame the sheep for getting eaten by the wolf, blame the wolf for eating the sheep.

A cool idea: volatile memory

[bigberk]

Brief terminology refresher: "volatile memory" refers to computer storage that is erased when power is lost.

This could be the basis for a beautifully secure public workstation (hardware security aside). Imagine a machine with maybe 1 GB of RAM instead of a hard drive. Upon boot, a static image of everything could be transferred to RAM.

So everything the user does is in RAM, and most importantly: rebooting is a guaranteed fresh start. Not only would this workstation be tremendously fast, but also relatively secure.

By the way, I got this idea after using Knoppix on some machines at school that have no hard drive.

Hire Literate Editors

[ari_j]

No shit. Piss-ass poor spelling and grammar in the body of a story is bad enough, but misspelling a word in the story's title is just pathetic. This is only made worse by the fact that at least some of the editors have probably attended college at a campus, seeing the word in print at least a few dozen times, at some point or other. They may have all dropped out, but that's no excuse.

Lock them down real hard!

[AndroidCat]

If I wanted to install something on a public Win machine that was "locked down", I'd hit my own web site on another machine. Load page, load custom ActiveX control = One 0wn3d machine. If the machine wouldn't load unsigned ActiveX, I'd have to work a little harder (or smarter).

BTW, I normally have IE prompt for *any* ActiveX load, and usually say no. (Some sites require it, argh.) I was kind of annoyed when Slashdot put an ActiveX on their page. I eventually made Slashdot a trusted site, but perhaps I should have made it an UNtrustworthy site to kill the prompts?

Re:Lock them down real hard!

[sconeu]

What does /. ask for? I've never seen that! Or is it for subscribers?

Re:Lock them down real hard!

[AndroidCat]

It's not Slashdot that's asking anything. They have (last time I looked) an ActiveX control on their web page. I set IE to ask before downloading any signed ActiveX control (unsigned disabled). So each time I loaded a page, I was prompted for the load again. That got old pretty fast, so I set Slashdot as a Trusted site and it doesn't ask me before loading a signed ActiveX control.

Re:Lock them down real hard!

[Amazing Quantum Man]

I think he meant which control does it try? I've never seen one either.

Given that slashdot is running Apache on Linux, I find it hard to believe they'd use ActiveX controls.

Re:Lock them down real hard!

[AndroidCat]

Perhaps it was one of the banner ads? When I get time (ha!) I'll take a look and see what's going on.

Check out www.loginguardian.com

[Anonymous Coward]

Cut & pasting (as a previous poster suggested) is a very bad idea, because it makes your password readily available to any other program on that machine.

Here's an interesting alternative:

Ask web sites you visit to use LoginGuardian (www.loginguardian.com -- I'll admit this is a shameless plug, but it needs to be added to the discussion)

(It's free for personal, government and educational use.)

LoginGuardian is a very simple utility that is installed on a login page by the webpage author. It's a simple javascript-based keyboard that enables you to enter userid & password without using the hardware keyboard (and so can't be detected by keyloggers)

It has some additional secure features to protect you from more sophisticated keyloggers.

There's also a very unique "universal password" feature that you can use to maintain online accounts by memorizing only one password and passphrase. Check it out!

(I'd be interested to hear from anyone who can suggest a practical method to circumvent it, cross-scripting browser bugs not included :)

pocket change

[Servo]

In reality, $2000 isn't much money when talking about the possibility of how much the guy could have stole with that many victims.

If your going to ruin your life over fraud, you might as well go all out.

kerebos?

[twitter]

The article makes me laugh:
Richard Smith, a Massachusetts-based Internet security consultant, said the software in question is typically used by jealous husbands or wives to spy on their spouses -- or by employers who want to snoop on their workers. ... "With the amount of information he gathered from so many different people, there could have been a lot of things he could have done," Smith said. "I'm surprised this kind of thing hasn't been done more often."

Gee, Dick, that would be because the early adoptors of computer technology, such as MIT had a clue. Oh, you and the University thought you could just buy some stuff from M$ and be done with the work?

Now, my old friend, the Waffle Iron, needs some help understanding part of MIT's system. Someone who tried to mod a public terminal for their own use is likely to be bit by this dog. Hardware capture by additional device is another issue, but I'll bet the MIT folks thought of that too. In any case, someone with enough brains to do all that would have enough brains to avoid stupid stuff like that. There's always someone better and they will get you.

Re:kerebos?

[Waffle Iron]

Now, my old friend, the Waffle Iron, needs some help understanding part of MIT's system. Someone who tried to mod a public terminal for their own use is likely to be bit by this dog [mit.edu].

How does Kerberos prevent local hardware or software tampering with a terminal? It is an authentication method for talking to servers.

If your local terminal is compromised, all bets are off.

Re:kerebos?

[mbogosian]

Smith said. "I'm surprised this kind of thing hasn't been done more often."

What Smith meant was, "I'm surprised we haven't found the tens or hundreds of other attempts to do something similar."

Boston College IT must seriously blow. Even on a single user operating system (like Mac OS 9 or Windoze 9x), there are tools (some based on rdist) which you can use to completely restore the machine to some known state after a completed user session. It's not that hard to force users to initiate and kill individual sessions either. It's a hack, but it would have made an effort like this a little more difficult.

Re:kerebos?

[twitter]

How does Kerberos prevent local hardware or software tampering with a terminal? It is an authentication method for talking to servers. If your local terminal is compromised, all bets are off.

Off is the word. If the terminal is comprimised, the server would not talk and you would not be able to login, much less browse on over for some one click shopping at Amazon.

Can you give me a hand here?

[Destroyed]

If that law were in effect there would be a lot of one handed (and no handed) people. If anyone considers chopping of the hand to be a good punishment ask yourself what if some guy turns out to be innocent after 2 years of jail for example. How would someone like that get a job? They might end up having to steal. Plus think about downloading mp3z that you don't own. Can you imagine loosing a hand because of it? How about some old lady trying knowingly to use an expired coupon? Is that considered stealing and if so does grandma loose a hand? Maybe forgiveness is the best idea. I'm actually more against violent crime, but I won't steal anything in Saudi Arabia:).

Re:Can you give me a hand here?

[Glonoinha]

There are two kinds of crimes (well more than two, but two I am going to work with for the sake of this discussion.)

Crimes against the system.
Crimes against an individual.

Crimes against the system would be Warez, MP3z, even grandma using an expired coupon, not having the proper license to operate a vehicle over 6000 lbs, driving 75 in a 55, using a radar detector in the state of Virginia, or reading someone else's diary. These are crimes that involve doing something that society has said they disagree with you doing - but note that no one person has been harmed in a material way. Warez/MP3z in theory deprive the system of money they feel they are entitled to had you obtained the stuff in a legit manner, but the truth is that you would have never paid $995 for the latest Photoshop so you could play with it on your home computer.

A crime against an individual is different - this is picking a particular person and either harming them physically or in a true material fashion (ie. taking their stuff.) The State of Texas has defined this type of crime with no gray area, and has said that if I catch you doing it to me or my family I can kill you. The State of Texas encourages me to put a gun to your head and pull the trigger and splatter your brains all over the sidewalk, killing you, for this particular kind of crime.

If the no-talent ass-clowns that legislate in Texas can see the difference between these two types of crime, I am sure that the enlightened citizens of /. can too.

And I'm with you - there is no way I am going to steal anything in Saudi Arabia :p

Re:Can you give me a hand here?

[Kashif Shaikh]

Many people think, "Why do those Muslims cut off hands if they steal?". It's more of a pratical deterrent, to stop people stealing from each other. And in serious cases, to stop murders and other crimes resulting from theft.

A while back here in Canada, we had an incident where one guy robbed a store with expensive goods, and left the scene immediately. Cops were chasing after him thru the roads and highway, and finally when a cop stopped the guy. The guy had no remorse, and pulled his gun out and shot the cop point blank in the face(as the guy was getting out of his car). The guy got back in his car, and proceeded with his getaway...even some bystanders got tried to follow him...but when they did the bad guy just tried shooting those cars. Also last time I checked, the cop who got shot in the face is recovering.

All attempted murders, violence and damage...due to what? Theft. Islamic Law immediately puts a severe disability on anyone commiting theft, and there is no point trying to discuss if this is "too severe", as one can just go to Saudi Arabia and see the implementation of this Law. You can practically keep your store open unattended(if you have a shop) and no one would steal.

The only one who suffers? The person who commited the theft. Fine by me, because that person has a brain and a capability to think before acting. Sure he might 'repent' from his mistakes, change, and never steal again -- but it doesn't change the fact that s/he stole in the first place. Afterall, what if robber, stole your pay check for feeding your family this week?

And, if anyone is really interested, I can give you more information about punishment of theft in Islamic Law, with all of its cases and conditions.

ATMs too

[kwenda]

I saw something, I want to say on Discovery - a documentary on counterfieting. Anyway, there was a group of people who wheeled an ATM into a mall and set it up to look like a legitimate bank machine. They left it there for a period of time, but it never dispensed any cash. Instead, it would read the magstripe on the card that was inserted, and then record the PIN number that the user entered. It then printed out a message that it was unable to contact the bank, or the customer was out of cash, or whatever. After that, the crooks came back and wheeled their ATM back out the door - along with hundreds of valid ATM card and PIN numbers.

Re:No. This is worse than simple theft.

[Travoltus]

Hopefully he will get one year for every count of invasion of privacy, one count for every person.

He'll be getting out when Jesus returns.

Sysadmins and Slashdot

[duck_prime]

[...] since I'm the admin, it's my job to fix it. Of course since I have so much free time and generally do nothing all day except post on slashdot, this isn't a problem, right?

This was about to be funny and sarcastic until I got a desk in our company's IT department. I've never seen so many Slashdot sessions in one place before... ;)

I'd love to see some statistics as to which external sites are hit by which departments. I know we have the technology to do this, but I doubt any company would want to take official cognizance of the obvious fact that workers web surf betimes.

appropriate permission

[Anonymous Coward]

Why not just allow users to run any programs they want, but not grant permission to do harmful things?

I've never really understood why, in the windows world, ability to run a chat client == ability to sniff the keyboard or reformat the hard drive or something.

Re:appropriate permission

[EvilSporkMan]

You contradicted yourself. If a user can run ANY program they want, they can run a keyboard sniffer or format the hard drive.

Re:appropriate permission

[Anonymous Coward]

You contradicted yourself. If a user can run ANY program they want, they can run a keyboard sniffer or format the hard drive.

No I didn't. I said:

Why not just allow users to run any programs they want, but not grant permission to do harmful things?

If they don't have permission to sniff the keyboard, then they can't run keystroke logging programs. But they can still run non-harmful programs.

Re:appropriate permission

[EvilSporkMan]

How would you do that without stopping them from receiving keyboard input at all? Writing

if(program==KEYBOARD_SNIFFER) Dont_let_it_run();

won't get you far...

Free hardware keyloggers?

[SuperKendall]

I think it's time to head over to the library, and see if I can find myself a free hardware based keylogger! You're right that it seems like people would be doing this already, so there must be some just sitting around on public computers.

It would be even more fun to find one, then set up a sting operation by feeding it specific data that they would use later...

Wha?

[cvanaver]

Only $2000? That isn't much of a return on investment for spending so much time and effort. One would think he could do a lot better. Perhaps he had too much data to work with. I think maybe this guy should have learned some scripting skills to harvest a few more credit card numbers

Clean Slate & Deep Freeze

[FsG]

Several people in this discussion have asked about Clean Slate and Deep Freeze, and whether they could've prevented this attack by securely blocking drive write access.

Having installed these programs on some of my school's machines, I can explain. The program itself is a low-level driver that basically sits between the OS and the hard drive. Whenever the OS wants to write to the HD, the driver does the writing and also makes a note of what was changed in a hidden location on the drive. When the machine boots, these notes are re-read, and the changes undone. This means that you can go to C:\, Select All, Delete, Empty Trash and it'll really be done (well, most of it; you can't delete certain things) - but the driver will remember those changes, and undelete everything when you reboot.

Can it be defeated? You bet. A classmate of mine demonstrated defeating Deep Freeze by booting from a Linux floppy and simply renaming the driver files, preventing the program from loading itself. He then proceeded to install StarCraft (back in Windows), then repeated the linux-boot procedure and restored the drivers, effectively preventing anyone who didn't know the Deep Freeze disable password (or the Linux solution) from deleting the game.

Neat, eh?

Re:Actually...

[garyok]

IANAML, but I thought getting your hand cut off was for a second offense under Sharia law. A good slap for a first offense and trouble opening jamjars after the second.

Anyway, in the "civilised" west we could add a few wrinkles, like instead of throwing the offender's mitt to the mutts we could stick it on ice for a few years. Then, when the bad man has behaved himself, and said he's very sorry for being naughty, and promised he's never going to be naughty again we can re-attach it with microsurgery.

I think this would be especially appropriate for teeny car thieves. Find out which hand they spank the monkey with and and then ice the paw until their majority. A couple of years having to satisfy themselves with the wrong hand (because car thieves ARE wankers) and they'll learn the error of their ways. It'd work the same for crackers too.

And if something goes wrong sticking it back on and their hand turns black and their arm has to be amputated at the shoulder, well... fuck 'em.

Keylogger still available at Thinkgeek...

[tandem_repeat]

ThinkGeek continues to sell these...here

Hmm..

[Glonoinha]

Ok, what if I supported you in this, but that your punishment for a single instance of malicious use of your bomb, anthrax, or smallpox was to have your lineage traced back four generations and every person was included in that family tree killed in a particularly savage manner, insuring that your genes (the bad ones) were wiped from the planet and were lost forever ... ?

That severe enough for you?

Most of the people here in /. are technically savvy enough to capture keystrokes, install spyware, and odds are most of us have done a little snooping of data we were not exactly entitled to ... whether looking through other people's computer, flexing a little sys/admin muscle, exploiting a security flaw, etc... That doesn't make us bad people - but when one of us starts using this knowledge for criminal gains ... off with his hand!

Re:Hmm..

[anon*127.0.0.1]

Is that severe enough for me? No, not really. Maybe you haven't noticed that there are fanatics out there who are more then happy to give up their own lives to further their cause. Somehow I can't qutie see a finger-wagging "Don't set that bomb off, or you're really be sorry!" being much of a deterrent.

Not to mention that tracing my lineage back and wiping them out would be punishing a bunch of innocent folks. What if I hate my family? What a great way to get back at them!

Re:Hmm..

[minister of funk]

Not to mention that tracing my lineage back and wiping them out would be punishing a bunch of innocent folks. What if I hate my family? What a great way to get back at them!

So... what do you call stealing... using anthrax/smallpox, exploding bombs...

Re:Hmm..

[anon*127.0.0.1]

I'm not sure I understand what you're asking.

Re:Hmm..

[minister of funk]

I was reacting to what you said about "Punishing a bunch of innocent people," and missed the tongue-in-cheek humor about "not liking one's family."

I was asking, "Is there really a difference between regressing four generations in the family tree, finding all descendents and killing them; versus using weapons of mass-destruction?"

As I rephrase this, I begin to see there is a difference: wiping out a relatives is a very personal, retaliatory, vendetta-driven method of revenge. Using weapons of mass-destruction could cause more casualties, and have long-term effects, and is less personal.

The former smacks of genocide... I suppose the latter does, too.

The difference lies not in the effect but in the motivation. We have escalating retaliatory battles raging, each side trying to out-retaliate the other, always committing larger atrocities, stretching the rules of engagement.

This post is a bit off-topic, no?

Re:Actually...

[Glonoinha]

Most of us do, it is called Windows XP (or Windows 2000 sp3.0.)

ATM Usage

[nurb432]

No, I don't us ATM's. I use that elusive endangered species: 'CASH'. Gotten direct
from a live teller.

Both for security of my account, but more importantly privacy.

The government doesn't need to know what I buy, or where I buy it at. its none if their damned business. Even if it is just lunch.. or a book on how to build a machine pistol.. they DON'T need to know.

look at the location

[Anonymous Coward]

It happened at Boston College! If the person tried this at Boston University, the IT department would be on it in a second, the hockey team would win the beanpot, chapagne would fall from the sky, etc.

As a current BC student

[Trefoil3]

let me clue you in to just a few things. a - a majority of the kids here do come from VERY wealthy families. Of course there are your fair share of typical college students, but there is more than enough people that probably wouldn't notice a few bucks missing. that being said, he was probably only taking a small emount from everyone. b - the "money" he stole [from my understanding] was what they call "eagle bucks", meaning it was good within the university, could be used the the bookstore, dining hall, etc etc. There's no real way to withdraw this money, so i'm guessing that there's really only so much stuff you can buy on campus, and $2000 will cover that. c - the real issue in this whole thing is the BC policy with PIN numbers. they assign you one at the start of freshman year [or when you're hired] and it never changes. when this whole issue surfaced IT had to scramble for a way to let everyone change their PINs. Now we're getting an entirely "new system", with new IDs and supposedly a bunch of other "security features" that don't sound all that innovative or secure. d - i can't believe that a cs major from BC made slashdot. although i didn't really know him, i think he was in a few of my CS classes.

Thin Client or Novell

[theolein]

A thin client would be an ideal solution to this kind of problem except that thin clients have become very much out of vogue, although they do allow admins to have much better control over the system. Another approach, although rather expensive and ungainly, is Novell's ZENworks. It allows an admin to control what is on the users machine and what not.

I see the solution as being a compromise in allowing users freedoms and controlling the workstations. Ideally the computer would be regularly monitored, but this can be difficult in an environment where there are thousands of computers.

i'm sorry but...

[fandelem]

TWENTY YEARS IN PRISON for this? when murderer's can get off on manslaughter charges which results in 3-5 years, plus parole?!?

something is seriously FCKED UP with our judicial system to allow a petty crime such as this cause twenty years inprisonment. something just is NOT right. gawd.

my predicition is that in fourty years (by the time i'm an old grampa) computer crimes like these will finally be reduced to misdemeanors and such. when enough of the population is doing silly things like these that they have amended and reformed the newly idiotic laws..

twenty years.. geez.. what is this world coming to??

more than $2000

[Anonymous Coward]

I dunno (doubt) if he had the guts to try it, but with keylogged data on that many people, there has got to be more than a couple hot girls with blackmail-able problems...

but you're an idiot

[Anonymous Coward]

stealing is wrong, any way you look at it.
using GNU to steal is even more wrong.

stop being a criminal you idiot

Jesse Helms, is that YOU????

[Anonymous Coward]

Jesse! I think you need to press that buzzer by your pillow and have them change your depends.

Supposedly...

[kyz]

From http://www.codeguru.com/system/Lock.shtml:

To intercept keyboard and mouse input I install a system-wide hook. A hook is a point in the system message-handling mechanism where an application can install a subroutine to monitor the message traffic in the system and process certain types of messages before they reach the target window procedure. To install a hook use SetWindowsHookEx() function.

To disable special keys (Ctrl-Alt-Del, Alt-Tab, Ctrl-Esc, Windows key) I used SystemParametersInfo() function with SPI_SETSCREENSAVERRUNNING flag. Even though applications are not supposed to use this flag, because it is used internally in Windows 9x, it does the job.

Also note that Linux has a 'pseudo-SAK' key, Alt-SysRq-K. It's not a true SAK, as XFree86 (and any other program with root priveleges) can take control of the keyboard if it wants to. However, Alt-SysRq-K will kill normal user processes on the console (also, processes with root priveleges that don't take over the keyboard handling) and return you to whatever the /bin/login program is today.

Re:Supposedly...

[Anonymous Coward]

Yes, I have also found that hitting SysRq will kill ncurses apps instantly, although I am not to sure about those on other curses systems.

The Perfect Scheme

[Artcfox]

1. Install keystroke monitoring software...
2. Wait...
3. PROFIT!!!

FUCKING PRICK SHOULD BE SHOT

[Anonymous Coward]

What a dumbass for 2grand? Mother fucking assholes like this make admin's lives hellish. just for a prank or some measly cash they wreck havoc on other peoples lives. This same punk will move to creditcard/phone/swindle your grandmother scams next time.

I SAY JUST SHOOT THE FUCKER

Solutions?

[gad_zuki!]

When I use a computer at the school lab I always run Trend Micro's Housecall in the background. That is if they haven't disabled ActiveX. I'm assuming it would catch the popular keyloggers and trojans. Of course, its nearly impossible to stop someone who is really motivated from keylogging, stealing, murdering, etc, but it sure beats nothing and if I do find something I'm making sure someone who makes policy will hear my complaint.

How about an app which listens for keyloggers? There has to be a way to detect keylogging regardless of how its done. Why can't this be built into the heuristic part of anti-virus scanners?

How about a virtual keyboard? Web-based services (hotmail, hushmail, etc) could spring up a Java box with randomly ordered letters and numbers and you simply use your mouse to click on the proper letter. Just make it small enough so no one can shoulder-surf without making themselves noticable.

misspelled

[riceboy50]

The title says "College Compus" but should be "College Campus" This isn't that important but I figured someone will wanna correct this.

You laugh

[ACNiel]

But this is a natural consequence of RMS's philosophy.

Who decides what is private, what should remain private, and what is public information that wants to be free.

Knowing your banking records might make my job as a prosecutor easier. That should be public informations. Knowing that you are courting someone else would allow me not to make a fool out of myself by asking you out, so that should be public information.

this isn't funny, as much as it points to the failure of RMS's thinking. Is he going to be the one that draws the definitive lines?

Ctrl-Alt-Backspace?

[zCyl]

I would think Ctrl-Alt-Backspace would work just as well in X. Is this user-trappable in any way? (assuming text login prompts are disabled)

(OT) Dems nowhere near as corrupt

[JimmytheGeek]

They can't afford to be. Clinton had ONE underling convicted of underreporting payments to a mistress. Reagan had dozens, Bush I likewise, and though there have been no convictions yet, Bush II's is the most corrupt admin since Harding.

Re:(OT) Dems nowhere near as corrupt

[cyb3r0ptx]

That wasn't intended to be 'my party is better than your party' rhetoric, but rather point out that the business of the elite is to be corrupt and self-aggrandizing. I wasn't referring to martial infidelity, but rather the Mark Rich pardon that even Bush II has been tight-lipped about.

rms, the great

[Anonymous Coward]

rms is the greatest man alive!

screw 2000 dollars...

[Magius_AR]

Do you know the value of information sitting on some hot chick's PC at any random college? Emails, AOL IM chat convo, documents, etc...wow...

I can see it now:
Some Hot Chick: "Wow, we've really connected in the past couple days, it's as if you know me better than I know myself. Wanna go to my room?"

Reading some emails: Fun
Sniffing some credit card numbers: $2000
Having a sex monopoly on all the hot chicks at your college: Priceless

typos

[Anonymous Coward]

I gleamed a lot when I was on compus

Now if they would just arrest spyware authors...

[MMHere]

Anytime you get a positive hit with AdAware, an arrest warrant is sent out for the author of the spyware module found...

Last Post!

[alpg]

The Man Who Almost Invented The Vacuum Cleaner
The man officially credited with inventing the vacuum cleaner is
Hubert Cecil Booth. However, he got the idea from a man who almost
invented it.
In 1901 Booth visited a London music-hall. On the bill was an
American inventor with his wonder machine for removing dust from carpets.
The machine comprised a box about one foot square with a bag on top.
After watching the act -- which made everyone in the front six rows sneeze
-- Booth went round to the inventor's dressing room.
"It should suck not blow," said Booth, coming straight to the
point. "Suck?", exclaimed the enraged inventor. "Your machine just moves
the dust around the room," Booth informed him. "Suck? Suck? Sucking is
not possible," was the inventor's reply and he stormed out. Booth proved
that it was by the simple expedient of kneeling down, pursing his lips and
sucking the back of an armchair. "I almost choked," he said afterwards.
-- Stephen Pile, "The Book of Heroic Failures"

- this post brought to you by the Automated Last Post Generator...