Slashdot Mirror
ABC TV Does Two Major Cracker Stories
karma vs Dogma writes "ABC ran a couple of stories tonight on the "Evils of Crackers/Hackers". Read the summaries of the World News Tonight story and the 20/20 story. I am just wondering where they keep getting these huge figures on the costs of replacing one html document with another."
Not having seen that actual broadcast, the summaries don't mention any actual costs, only that if you deface a website making $18mill a day you are commiting a serious crime (didn't say it cost them over $5 dollars).
Hacker/cracker I don't know anybody who came from that era that cares about that.
My opinion: all the newbies complaining and whining don't have much of a leg to stand on when they moan about a phrase that came before their time; when the people who originally used it, have resolved that it really doesn't matter anymore.
Note: spelling and grammar checking off because I don't care
Maybe what they mean is $300k to hire in a consultant or temp-admin, who actually knows how to FIX the goddamn problem, then change the sysadmin's diapers and hand the keys to the server back to him to go louse up again.
Also imagine another scenario.
... and..
...ummm.. owned.
..lets say Amazon if their website gets defaced with a similar message as above?
An e-commerce website's home page gets defaced with the usual elite cracker message.
Insulting the sysadmin.
Shouts to the peeps.
Links to places
"Oh yea sysadmin, thanks for your customers' credit card numbers. I am gonna have some fun this month"
Just imagine how seriously this can hurt the business. People get informed that the website has been "owned by some elite hackers' and the credit card numbers they used to purchase stuff there are
No matter what the website does to re-assure the customers that vital data has not been broken into, it will still lose MANY customers.
Will you purchase from
Simpleguy
Looked at another way, if I'm a drunk driver and run you down causing you to be unable to work, do you think you're entitled to the money you would have earned if you could work (as lost income), or only what it costs you to survive?
Besides, incorrectly routed packets still go *somewhere*, and icmp can still act as a return mechanism to indicate where these "hacking" attempts are being made so the admins can track it and temporarily assign static routes to the affected router(s). 30 minutes to take down, 30 minutes to bring back online. Again, this assumes the clueon index was particularily high at the affected backbones at the time of attack.... *cough* Not sprint *cough* ...
This doesn't preclude the possibility of a more long-term guerilla war being made on the backbones, but that wouldn't "take the whole 'net down in 30 minutes". It would make the evening commute more interesting though.. and I for one think it would give the community a solid kick in their complacency.
Personally, I wonder how many servers have been silently compromised inside these networks and are being used as relays for other attacks. If the cracker kept a low profile, such activity might remain undiscovered for some time. That is a much more serious risk IMO than some 30-minute orgasm of custom packets being thrown at the backbones.
I am just wondering where they keep getting these huge figures on the costs of replacing one html document with another.
;)
Well, don't you know that the salaries of all the SysAdmins, web designers, programmers, and consultants that happen to be working during the hour it takes them to fix the page all need to be paid. I mean, it's not as if they wouldn't have been there working anyway if the "hack" had never happened
Michael Gentili
- He's just some guy, you know?
This is how it works:
If my fence is broken and the neighbors mutt gets
into my yard. When I sue him, I can recover the
cost of fixing my fence, plus some overhead, and
lets see - oh my labour is worth $50/hour. Isn't
it obviouse, that the damned neighbors dog caused
the expense, never mind that I built the fence out
of rotted scrapwood.
I hope I am wrong in the assesment of the logic
being used in these cases, but I don't think I am.
probably ones like amazon, onsale, ebay,etc...
I'm just saying, it isn't that farfetched, considering the software a lot of people using the Internet use. Remember, the fact that the Internet can (theoretically) survive a nuclear attack doesn't mean that this kind of sabotage won't work, remember the Morris Worm? This kind of sabotage operates on a completely different principal than physical damage.
Of course, it may be that things aren't as prone to this kind of sabotage as we may think, but I think that just as the Schlieffen Plan would've insured Germany's victory in WWI if it had played out the way they expected (i.e. Britain and the US stayed out of the war) it is possible to have a plan that could take out the Internet, whether it would work in real life or not.
All the creatures will die, And all the things will be broken. That's the law of samurai. (Jubai, 1605)
I'm realy confused why a company which makes that much money (ok a signifigant amount) would even have a problem with fudged webpages like that.
Haven't there employees heard about checksums, backups and crontabs? I'm mean have a cron job check the checksums of the web site files every 20 minutes and if there off page the sysadmin or automatically restore from backup and recycle the webserver/servlet engine. This way the company would lose 40 minuts of business at the most.
Am I off here? anyone care to point out my oversights?
> SELECT * FROM brain_cells WHERE synaptic_rate > 0
0 row returned
Ok, lets break this down and cut through the bull****. No one can "bring down" the Internet in 30 minutes. The Internet isn't a building, or even a network, it's gotten so big that you can't really classify it like that anymore. It's almost---alive! I have no doubt that with large (or even not-so-large) flooding of key points that a person (or group) given enough time skill and bandwidth could disrupt things for a little while. BUT lets face it; l0pht isn't the only group that might possibly have a clue how to do this. If someone really knew how to do this, they would do it. Since this hasn't been done it's but an un-tested theory and doesn't amount to jack. I say take down the Internet if you can, lets re-build it right!
They sell $18M/day to consumers alone through their website.
The l0pht makes a point of doing tests and experimentation on their *own* machines. This is, in my mind, what separates them from crackers.
Cracking Groups like Global Hell play with other people's hardware without permission. L0pht, though, is not a cracking group. Duke was talking about the l0pht when he made his analogy, which I find to fit rather well with what they do.
Lets do it, bring down the Internet (*cough).. Then maybe we can rebuild it right!
Of course it is going to implode on itself eventually. Be it from lack of IP space or routing tables that have grown out of control, the Internet as it is today was NEVER designed to be this big, fast or spread out.
L0pht or whomever, lets get to it. If you have the code/knowledge/skill to do this, lets see it. In fact, if you don't want to for fear of legal consequences, send the needed information/code/resources to me and I'll do it. I don't think you guys are serious, I don't think you guys expect anyone to believe you. You could be right, you might be right, who knows. I repeat. Let's SEE IT.
Anyoen that can do this, put your idea/implementation where your mouth (or finger) is.
Second:Attrition.org
Of special note is the Attrittion Mirror of defaced sites. This will allow you decide how much "damage" is actuall done and how much "help" was actually done. Please not that this varies greatly by individual.
The problem that exists is that these people, often under 21, see big giant gaping holes in the security systems and this bothers them. If they report it, nothing happens because no one has, or ever will, listen to them. (Some sites have been defaced repeatedly, without ever having fixed the holes, even after the fix was placed in the HTML!)
So they make a mistake. They try to draw atttention to the fact before someone less kind, (for example a rival organization) uses the same holes to download actual sensitive information. (Warning, this kind of thought process can occurr to you when you've read too much cyberpunk.)
I'm older and wiser now. I realize that people REALLY DON'T care about security. Normally they just want something to rant about. The status quo is to lock your car door for security but if you lock the keys in your car you expect a locksmith to get them out in under a minute.
Think about it. If the locksmith can do it in under a minute, so can I.
They may not be adults, they may be fools, and they may annoy the computer professionals that are responsible for security but let's look at it this way.
If some kids can take down whitehouse.com, why couldn't Zhirinovsky hire someone to do the same, only with a lot more creativity and subtleness. (Wouldn't the media just love it if someone found a collection of porn jpegs on whitehouse.gov?)
They're criminals. They view themselves as unsung heros. In short, they're the Chicago Seven of a new generation. Even Richard Daley's famous quote could still apply:
"Gentlemen, let's get something straight. The police aren't in the streets to create disorder; they are in the streets to preserve disorder." -- Mayor Richard Daley
No Zen is good zen
Any "good" intruder can do a lot to cover his tracks, but all it takes is an admin watching network packets with the ISP of the source on the phone.
There's always a trail. It all boils down to who has the resources and time to follow it.
It amuses me how many l33t hax0r IRK kiddies there are that think they're indestructible, that the only kids that are ever caught are the ones they show on TV, that they'll never be discovered or prosecuted. And when the FBI raids their house and their parents are stuck losing their home and his college tuition money paying for damages, guess who's out there laughing his ass off.
Heheh. The intentional irony here is wonderful. My Spanish teacher hated that. Drove him bonkers. He did teach me that the Smurfs in Spanish are called "Los Pitufos."
Install the service packs that should have been installed anyway? I can't see how you can charge that to the intruder. Might as well charge the cost of adding cheesy javascript rollovers while you're at it.
If I were that "head of network security" that they quoted as saying it cost "hundreds of thousands of dollars" to fix a simple web page tagging, I sure as hell wouldn't show my face on national TV. Why didn't he hang a sign around his neck saying: "I am an idiot who is unqualified to do my job?"
The same "expert" talked about how much he feared what would happen when the cracker got out of jail, and wanted revenge. The cracker was using win98 on his MOTHER's computer! This was not someone any competent admin needs to fear.
This is nothing compared to what the police do after a drug bust. "We captured the drug-lord with 20 pills of ecstacy, with an estimated street value of 6.4 million dollars." Reality is it was some fucked up party kid with some pills for him and his friends, worth about $200-250.
Taking down the internet in 30 minutes for DUMMIES. (insert rimshot)
And a $17 million dollar a day site? Less serious? What about a $0 dollar a day site, say a unicef.org or whyme.com?
I'm sick of money being equated with importance.
I have no respect for script kiddies that deface webpages randomly, launch pointless DoS attacks, etc. They all seem unproductive and malicious.
Though I do rather like those people over at the L0pht. :) Original, creative, and damn, they actually DO stuff, unlike 99% of them damn script kiddies.
Still, I'm sick of all these [hc]racker stories. The media does seem to be doing a slightly better job lately though. Well, sometimes.
Script kiddies bother the hell out of me.
The first quote of the story: "Young cyber whizzes with knowledge to infiltrate the most secure computer systems in the world are growing in numbers and ability," should really be changed to say "Young cyber whizzes with knowledge to download freely available exploits that anybody with a minimal sense of security should be able to patch."
The worst part is that the media is the only thing that feeds the so-called 'intelligence' of most people. I guess thats why the world seems to be in a downward spiral. It'd be cool if journalists would ask for expert opinions from people who know something about the subject, but I think they teach you not to do that in Journalism101 or something.
-- toolie
"...the members of L0pht see what they do as neither good nor bad."
""We feel we're actually making a difference," says one L0pht member."
Is it just me or do those two phrases seem to contradict each other?
I read that first article about the secretive shadowy sinister L0pht gang, and laughed so hard I spilled my coffee. Oooh yeah, L0pht is a big top secret all right. I'm sure I can rely on the rest of the /. readers, insiders and conspirators one and all, to not publicly reveal the location of their top-secret underground web site at, just guess, yep you got it, www.l0pht.com, 'cause if the Man finds out, whooey!
If the major media could stop kissing Jeff Bezos's ass for just a few minutes they'd see that amazon.com's fraudulent patent is a bigger threat to the Internet than all the hackers in the world put together. But Bezos is a billionaire, and Americans - rich ones, at least, like the management of the mass media - don't seem to be able to think clearly in the overwhelming presence of billionaires, whom they worship, unreflectively, disgustingly, just like a crackhead worships a big old chunk of crack.
Yours WDK - WKiernan@concentric.net
If anyone is seriously interested in this topic I suggest learning the BGP routing protocol paying close attention to the authentications mechanisms or lack thereof. Then study the network topology of the backbone provider interconnection points (the NAPs and MAEs). Then learn how to craft your own packets with a library like libnet. Then do some long nights of experimenting (on your own equipments of course).
If you don't want to do all that work yourself you are going to have to trust us. :-) Remember, things never work like they are supposed to. If they did there wouldn't be nearly so much hacking!
weld@l0pht.com
Second, we must make the assumption that if one file has been altered, -any- file on the system could have been altered. Remember, don't use tripwire, or any similar tool, as this will eat into your damage assessments. Figure in the time of a complete deletion of the system, a fresh re-install of all applications, and finally a restore from your latest backup tapes.
Remember, system restoration should be put in as overtime, so your figures for damages should reflect this.
Then, you must factor in the cost of the system being down, in terms of time lost (wages) to all company employees over the entire day, even if they probably wouldn't have used the system at all. It's still a loss of potential, which is still a cost.
Then, you must factor in the cost of calling in the technical support people from the company you bought the system from, to fix the security hole. Even if you buy technical support, when you get the system, you're still using it, so there's still a cost -somewhere- in the system. Fixing the security hole yourself is a big no-no, as this would imply incompetency on the part of the technical staff. As technical staff are, by definition, competent, any hole that exists must be obscure and only known to the company that you bought the system from.
Then, consider the cost of loss of revenue from any banner adverts your site carries. That it's not your loss is irrelevent. It's still a cost of the damage. Assume everyone who enters your site follows a banner advert and purchases something. This may not be entirely accurate, but it's a possibility, so it's still a potential cost and therefore counts.
Finally, consider the cost of image. Any points lost on the stock market, that day, are potentially a result of the system crack, so you can estimate how much the company lost in value as a result. It's important to remember that, even when any other factor in the Universe seems more likely, always assume the worst possible case, for damages.
This completes your class in damage assessment and valuation. You are now qualified Public Relations officers, capable of handling the worst system cracks with dignity.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Get a clue ya moron. Amazon is losing money because they are investing their revenues in advertising and branding..etc. If Amazon wanted to turn a profit they certainly could. I'm not sure how much of a profit, maybe not enough to justify the stock value... but I'm sure they will be able to show a profit when wall street starts to demand it.
While the figures cited are somewhat bloated, there's a lot more cost associated with something like this than simply putting the cracked page back up. I've worked in organizations where this has happened (not my fault, though ;>) and it usually leads to 1-2 weeks of beefing up security to prevent the same thing from happening again. This will usually include generating new passwords for all users in the system and phoning them to get the new passwords out. For public/non-profit organizations this can mean several thousand dollars and a couple hundred man-hours of personnel time which could be spent doing more important things.
JoePyro "It's a joyless existence, being smushed" -Larry Wall
Wow! I'm not sure if those articles could have been more devoid of content, yet still so sensationalist.
We have a group of hackers (crackers? smackers? ugh...) who claim they can crack any password in seconds and bring down the entire Internet in, what was it? 30 minutes? And the 'reporter' just lets the statements stand! He didn't question (seem to) question them on how feasible this really was or go and talk to security professionals for their take on the claims. Without any attempt to refute or prove their boasts, you'll have even more people scared of the awful hackers. Sigh...
Dana
yet again the terms hacker and cracker are
confused !
what a surprise ?!
oh yeah the showdown of "government vs. hackers"
This guy about the computer virus is stupid. Obviously he has never heard of a backup. "All of its gone forever." PLEASE!!!
that was a very intriguing article.
i want the uswest database of numbers being monitored by the police!
actually, i wanted it 3 years ago when I was dealing. Now, it wouldnt be nearly as exciting.
Juln
And if you had any wits you might have guessed that that's where I got the idea from. Have a young person take you to a doctor for senility and overt crankiness.
Of course, I hate the way they do these types of stories anyway, and that FBI guy was the stiffest, most humorless and least charming guy I've seen on TV in a long time.
All the creatures will die, And all the things will be broken. That's the law of samurai. (Jubai, 1605)
If someone really knew how to do this, they would do it. Since this hasn't been done it's but an un-tested theory and doesn't amount to jack. I say take down the Internet if you can, lets re-build it right!
Let's translate this into a real world analogy, and the absurdity will be evident.
Some group says "This bridge that is the main route into or out of this large city is hazardous; all it would take is a large truck to ram the right spot on it and the whole thing would collapse."
''If someone really knew how to do this, they would do it''
Wrong. Not all people who investigate security holes are malicious. In fact, probably very few are, which is why we don't have more break-ins and such than we already have.
''Since this hasn't been done it's but an un-tested theory and doesn't amount to jack. I say take down the Internet if you can, lets re-build it right!''
So you're going to blow up a perfectly usable bridge, causing another to be built at great expense, just because you can? I suppose you're going to volunteer your time to help re-build what you so carelessly destroyed? No? You don't know how to build bridges? Maybe you shouldn't be so eager to tear them down, then.
Safety groups in the real world are all the time pointing out how dangerous products are. Why is it when a group does the same about computer security, they get roundly flamed no matter what they say or how they say it?
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
Umm, this is like saying "Does Fort Knox deserves greater protection than a convenience store?"
The risk and potential damages are much greater to a big corporation, so it would be kind of stupid to afford it no extra protection. (duh)
Jack Valenti and the MPAA are to technology as the Boston strangler is to the woman home alone
...right after that, he explained how he was so intimidated that he started paying protection money to the crackers so they wouldn't do it again.
My guess is the network just listened to what the company said, and didn't research just how difficult it is to restore from tape :-) Also, here we go again with the hacker/cracker debate...I wonder if any media will ever get that one right????
A three hour tour, A three hour tour......
The security guy's justification was that if he had turned the hacker in, he would have become a target of global hell.
Furthermore, he felt that since he had paid one global hell hacker, he wouldn't be attacked by anyone else in the group.
Two Thoughts:
1. Holy racketeering batman. Say what you want about whether or not hacking systems is ok, but doing it to extort money from people is unjustifiable.
2. Stupid sysadmins who pay hackers are idiots. This is like paying off the mafia and keeping your mouth shut about it. Sure, you'll probably be safe. But you've just encouraged them to use the same tactics against other companies,insured their existence FOREVER, and you're going to have them on your a** that whole time.
Jack Valenti and the MPAA are to technology as the Boston strangler is to the woman home alone
Did anyone else notice the Battlezone arcade game in the background? Hey, these hackers have TASTE.
Anyway, the $18M/Day is probably gross sales, not net profits.
Both of those stories were annoying, but what bothered me the most was ABC's general attitude that hackers will do malitious cracks because they can.
It's like saying the FBI should keep a close watch on Alan Cox because he convievably could add a backdoor hack to the Linux kernel allowing him to break into any system that used it.
Routers don't like it when they run out of memory, especially Ciscos. I ran into similar issues when I was implementing OSPF and accidentally killed a dozen Ciscos, a few Ascends and Portmasters with some miscrafted packets. Its harder to do with MD5 authentication in place though.
Sanity is a sandbox. I prefer the swings.
-----------
"You can't shake the Devil's hand and say you're only kidding."
i think you are misunderstanding what he is saying. the explanation is not a DoS (denial of service) but a routing corruption. the internet would still technically exist, except only as fragmented networks. example: to get to 'A' from B, go to C, then D, then A. however, if someone inserts go to C (or go to B) into the route after D but before A, you could never get to 'A', since the route never actually gets there (it loops back on itself. it could just as easily point to 'G' instead). like he said, there is no security on the route advertising in BGP4. a similar thing, though i believe it won't work (well, not anymore, they finally have security on this stuff) is corrupting the DNS tables by saying the ip address of www.foo.bar is 0.0.0.0 when its actually something else. if that propogated (which it would except for the trusted source and other such checks) then www.foo.bar just fell off the 'net. now, scale that up. fill the entire DNS table with everything's IP address being 0.0.0.0, and once it propogates, the only way to reach something is via its IP address (which 90% of people using the net don't know.)
Note that they do not claim replacing one page with another costs millions of dollars, but that they claim shutting down a website of a company making millions of dollars is a crime.
Suppose someone took down index.html at www.amazon.com for an hour. That coulde easily run into high losses for them, since their business is web based. I wouldn't know about index.html at www.cocacola.com, though. Do they make any money with their site ?
superblog.org: all your favourite blogs on o
The comms are run out of Ft. Richie in Cumberland MD, and not even remotely connected to the Web site.
Also, the Web site is just brochureware, there is no gateway to anything important.
More race stuff in one place,
than any one place on the net.
It's the lack of background and CONTEXT that really detracts from the credibility of these mass media news reports (this applies to places like zdnet and c|net also). They never mention the types of computer services (aside from web servers) that are attacked, or even begin to hint at the general methods which are employed. This inability to provide real information seems to indicate that these articles are nothing more than fear mongering dollar grabbers.
I've read in a few posts here on /. that the target audience of these stories is not interested in the technical details. I will agree to a point, but only because I can't recall ever seeing real information ever being presented to the masses and it's never been tested. Until such a time as when they actually present a frame of reference for their stories, this amounts to nothing besides fear mongering.
What I'd like to see is an article on the damaging effects of fear mongering on businesses. How many dollars a year are lost due to uneducated pontification and agenda furthering FUD campaigns? How many businesses have lost money because a panicked executive heard from a friend of a friend that X problem is at hand and emergency procedures ,costing millions of dollars in capital and man-hours, must be put into place, only to find out later that it was not good information?
Stop knee-jerk reactions. Put a muzzle on poor journalism. Educate, don't pontificate.
-- kwashiorkor --
Leaps in Logic
should not be confused with
Jumping to Conclusions.
L0pht Heavy Industries had the Battlezone full upgright arcade game. It looked to be in very nice condition, but it was not powered on. No doubt, an elite hacking tool. (Real programmers go for those vector screens -- raster is way too easy to code for.)
What the heck are they supposed to do if they need a multi-processor server? OpenBSD can't hack that and they have NO plans for multi-processor OpenBSD.
I was going to (politely(maybe)) inform them of the difference between hacker and cracker after I saw it, but the cowards don't post their email adress from their website. Does anyone know what it is?
This post is not insightful, its untruthful. L0pht does their work on their OWN machines. Go listen in on the NPR interview they did a few months ago. They make a direct qoute/phrase addressing your allegations.
The lack of fact-checking is what has everyone so upset at the reporters.
I don't see why anyone would consider these crackers (sorry, the misuse of hacker really peeves me) to be dangerous, since most of them don't actually know crap about computers (the exception being L0pht, who I would place more into the hacker category anyway). They're just downloading exploits from Bugtraq and trying them out. If you keep you stuff up to date and are smart with your initial configuration (ssh2 and sftp access only, tripwire, logcheck, etc) any attacks that aren't prevented outright should be noticed right away.
Of course, it's not an ideal world, blah, blah, blah, but anyway my point is that people should be protecting their computers with real security, not laws that only "solve" the problem after the fact.
It takes ONE mailing list to find out about these problems in advance most of the time. If their sites are worth so much money to them why can't the invest the 2-45mins each day to check this stuff out!!??
I think that's one of the crackers' points. If you browse through the attrition mirrors you notice a lot of the defacements actually leave a hotmail address telling the admin to email them for what is wrong, or stating the address of where they left the original index.
mcrandello@my-deja.com
rschaar{at}pegasus.cc.ucf.edu if it's important.
Hey! I resent that!
Did anyone else notice that they used the word 'crack' a couple of times, rather than 'hack'? Are things looking up?
"I have never let my schooling interfere with my education." - Mark Twain
They were clear, concise and stayed well away from the impressions that all hackers are script kiddie punks.
Good Job!
More race stuff in one place,
than any one place on the net.
I caught the end of it. They kept referring to this group of script kiddies as a "virtual gang", I guess in effort to conjure up images of drugs and violence and organized crime. Which is of course what the script kiddies want, right, it makes them look dangrous and powerful. They really drove it home at the end of the segment, when they mentioned that one of the kids might go to jail for a time, and questioning "is the right thing to do?" They then got some human prop to say just how dangerous and pissed-off this kid is going to be after serving time. Give me a break!
Oh, and that's not the best part. The very next story was about a poor little sick dog who goes around the hospital giving sympathy to the poor little sick children.
This is blatant propoganda. Meaningless emotional arguments designed to focus our hate and fear. Those kids are so dangerous. And the puppies are so cute! What if those dangerous kids hurts one of the puppies! Heavens no! I hate those dangerous kids!
So let's recap. Kids with computers: BAD! Puppies in hospitals: GOOD! Now take your soma and let's all sing "I love Big Brother!"
Actually I noticed one of the guys running E. You could just see the bottom right of the screen, but I could see an iconbox and other stuff, enough to know immediately what it was.
We have enough youth, how about a fountain of SMART?
I thought these two articles were relatively well-done considering the intended audiences. There's a big difference between the average ABC News viewer and the average /. reader. ABC News shouldn't have the same depth of complexity, as the whole point of TV news is to take a complicated issue and explain it in terms that the average Joe can understand. This can be done poorly, but sometimes it can be done well. I think these two articles are done relatively well. In particular, the World News Tonight article gave a good summary of the good/evil qualities of h/cracking (i.e., cracking reveals security flaws that can be fixed).
Yes, the majority of media coverage about hackers/crackers is really paranoid, but this one wasn't so bad.
"They cite a webpage that's making $18 million per day. If it's down for a day, that's $18 million they just lost."
No, that's $18 million that they never made. There is a subtle but important difference. You can't lose money you never had.
________________________________
The game was shown in the *offline* version of the article (aired on TV).
Last spring I developed a site for a small business using OpenMarket's ShopSite. It sells for $495, and has a great backend for keeping track of products and orders. It's quite flexible, though it could be more flexible. Overall, it's a really good product - easy to use for the client, and I haven't had many callbacks for support, though they have done a substantial amount of business.
-Alex
From the unabridged article:
One web designer was quoted as saying "Of course we have backups - what does that have to do with it? Just because our servers can continue running for 30 minutes in a blackout, how does that help us get our website back?"
At that point his trainer hit him across the nose with a rolled-up newspaper, and confiscated his copy of frontpage, saying he had to use notepad for the rest of the week.
L0pht doesn't do their testing on other people's systems. They're a relatively respected group. Even Congress likes them.
Think about it: there are lots fewer people out there that know about routing protocols than know about, say, Unix. How would even your average slashdot reader know what their vulnerabilities are, much less the general public? It's easy to make fun of what you don't understand; most of us should understand that from experience. Given the track record of these guys, I tend to believe them when they say that something like this can be done. I just hope that the people responsible for the various pieces of the backbone listen and fix holes.
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
But, elvis isn't dead.
Sheesh, you people will beleive anything 20/20 says.
I read it as, "a web site that makes the company $18M/day." If they're pulling in $18M of revenue from their web site alone, and that web site is out put of commission for a day, they will not make $18M that day. Thus, the outage cost them $18M in lost revenue.
It's just not that simple. There's no doubt that most of these monetary claims are vastly exaggerated, but it's not just a matter of replacing an index.html file. If someone broke into your house and spray painted a tag on your bathroom wall, would you just shrug it off, clean it, shut your doors, and continue on with life? No. You'd beef up your security.
That's irrelevant to the cost of replacing the web content.
This is the cost to fix your security holes; it has nothing to do with the web site at all. If there are security holes, then it's the administrator's job to fix them, and this can't honestly be counted against repairing the website; these are two different things. (The cost for a sysadmin's time is already paid for - it doesn't matter if he's doing it adequately or not.)
Fact is a lot of these sites may be "asking for it" with their poor admins and shaky security, but that doesn't make it right.
Nobody is saying that it does make it right - but that has nothing to do with calculating the cost of restoring a website from a backup.
Been there. Done that. I have had the displeasure of meeting most of the members of 'Global Hell'. Let me describe them to you. It's a bunch of kids, and a bully. Very simple. Mosthated, who is the leader of the Global Hell, is the bully, and mostly everyone else is a kid. The kids hang around the bully because they _need_ the vindication of being cool, of having a peer group. These kids have no self esteem or self worth. The amount of control Mosthated shows over them is quite disgusting. He says something, they all agree. He laughs, they laugh. I did get the opportunity to tell Mosthated that he was more cracker than hacker, and he didn't agree. But he did...decide...that he'd better leave me alone. I guess even Global Hell fears common sense.
But what can I expect from an AC.
You can have a perfectly competant sysadmin, one that performs his job 100% correctly, 100% accurately, and applies patches and security fixes exactly 0 seconds after they're announced and STILL BE VULNERABLE TO ATTACK.
It's not infrequent that a vulnerability will be discovered and exploited *before* it's announced on the major security mailing lists and web sites. There's also the possibility that it's announced at 3AM and the company silently rooted by 3:05AM. What are you going to do, have all your admins get paged at any hour of the day every time an e-mail comes to Bugtraq?
I won't disagree that some admins shouldn't carry the title. More often than not, a vulnerability is exploited long after it's been released, but THIS IS NOT ALWAYS THE CASE.
I really hate it when people go off bashing the administrators when they haven't necessarily done anything wrong or incompetantly at all. These guys are the victims. The script kiddies that mount these downloadable attacks are the people we need to be fighting here.
With viruses available for downloading from the Web, extensive computer language knowledge is no longer needed
Hmm...sounds like they're talking about script kiddies to me. I find it interesting that ABC focuses on the the 3vi1 h@x0rz as opposed to the lack of responsible security measures on the part of those who get cracked. Maybe these companies "making $18 million dollars a day" should shell out a few bucks for some decent firewalls, intrusion detection, and the IT people to run that show.
Keep your servers patched up, run them on UNIX boxen with extra security measures, and for god's sake, don't short-change your people for equipment or personel. It's really not that difficult.
I was particularly impressed that they chose the l0pht, which *is* a legitimate hacker group. I'm not so sure about GH, but they've made enough news to be worth mentioning.
I could see that if it was a big time e-retailer or Ford or something, but not at the scale of the outfit they were describing.
Sanity is a sandbox. I prefer the swings.
The sentence makes a lot more sense if we read it as saying that the company makes $18M a day, not the website. It means: "It is a crime to make fun of people who make money", and it is scary. Very scary.
JM
They spent a lot of time with them, a couple of days, researching I guess. and most of the content seemed to center around "We are the Sekurity experts".
I read something a while back that L0pht was formally incorporated and purchased by a "parent" company.
More race stuff in one place,
than any one place on the net.
There was the usual nonsense, like confusing crackers and hackers and getting crack attempts and viruses all mixed-up. But otherwise, a few things really jumped out at me:
* Global Hell came across as extremely juvenile.
* The so-called leader of GH (Patrick something) was just a typical angst ridden teen. He couldn't elucidate his purpose or ideals; his philosophy pretty much broke down to "All the corporations of the world are trying to opress me in some unexplainable way, and, oh yeah, I'm really bored."
* The world "brilliant" was used several times in relation to crackers, as if they're working on things that require a PhD and sophisticated programming ability. I'd hardly put exploiting security holes into that category.
Interesting overall.
Just
Another
Fscking
Perl
Hacker
in
Bankok
;)
By the way, something just now occurred to me concerning amazon.com's patented technology. Does amazon.com require the user to enter a password as well as the cookie info? and if the latter, doesn't that add up to more than Just One Click(tm)? I regularly shop at a couple of web stores which store at least your account name in a cookie, so when you jump to the "Checkout" page your name is already filled in, even including your credit card number (which is displayed as "xxxx-xxxx-xxxx-1234"). But to get to the "Checkout" page you have to present your password first. At any rate, that certainly wouldn't be new or unique (that is, patentable) technology for amazon.com to do it that way.
But if the everything you need for ordering is already stored in cookies, doesn't that present a king-size security hole? Suppose, for example, one of my co-workers orders something from amazon.com with their web browser. And suppose I want to play a mean trick on this co-worker. So I copy his cookies file. Now if all the customer info is keyed off the cookies in the user's PC, I can't exactly steal anything; even if I order something, it will get sent to the original shipping address. But as harassment, I can order up, say, twenty copies of "Mein Kampf" or "The Joys of Enema Sex" or something obnoxious like that on his credit card, with Just One Click!(tm). Is that possible?
I'm almost tempted to break the boycott to experiment. It would be easy enough; just make an actual purchase from one PC, copy the cookie file to a second PC, and see if I can make a second order with Just One Click!(tm).
amazon.com has got a LOT of customers. If there really is such a big, obvious security hole in their patented technology, then maybe these news magazines could make themselves really useful to their readers by warning them away, rather than blathering about the Dire Threat to American Security posed by a few industrious security hackers and a bunch of dumbass script kiddies.
At any rate I hope I'm wrong, and there is a mechanism which forestalls illegitimate ordering. amazon.com and Jeff Bezos can certainly go to Hell for all I care, but I'd hate to see all those innocent customers getting screwed.
Yours WDK - WKiernan@concentric.net
Good reference. I like it. But there are some hackers that are not just trying to cause trouble. Myself for example. I have "cracked" a few websites in my day, and my only intentions were to prove I could do it, and learn a little in the process. I have always left a message for the admin, and most times I receive a return message from him/her thanking me. Sounds corny, but its true.
=======
There was never a genius without a tincture of madness.
There are good hackers out there. Don't assume that just because you are not one, or do not know one that they don't exist. I have had my share of cracking systems, and I have never done it will bad intentions. I am mearly curious, and I want to learn more about the system and security systems. I always leave a note, and most times I actually receive a reply from the admin.
=======
There was never a genius without a tincture of madness.
Second, we must make the assumption that if one file has been altered, -any- file on the system could have been altered. Remember, don't use tripwire, or any similar tool, as this will eat into your damage assessments
Do you honestly think that companies stating they've suffered 10M$ in damages ever actually get paid 10M$ by the attacker?
Companies have to weigh costs. There's the additional cost of implementing and maintaining something like Tripwire (which, as another poster mentioned, doesn't do crap for data) against the potential cost of a system intrusion. If your company has the funding for it, they've probably implemented a modest amount of security mechanisms (including things like Tripwire).
If your company doesn't have this funding, compromises must be made. Does that make this company irresponsible, incompetant, or "asking" to be rooted? Hell no.
For those types of companies (read: most), you HAVE to make the assumption that the system has been compromised in more than one way, with back doors in place and that the intruder has access to your internal systems as well. You need to cut off the network, locate the exploit used to break into the system, and totally re-build the OS and applications on the affected systems (probably ones even suspected of being rooted as well). Not taking these steps would be far more irresponsible of the admins than ignoring security bulletins in the first place (assuming they even did, and that if they hadn't, it would have helped them, which isn't always the case).
Remember, system restoration should be put in as overtime, so your figures for damages should reflect this.
Yep. Damages accumulate as network or web sites stay unreachable. The costs of overtime would presumably be less than the costs of staying offline. If this weren't the case, it wouldn't be worth it and it could probably wait until normal business hours. (Of course, I'd still physically disconnect the machines from the Internet during this time.)
you're still using it, so there's still a cost -somewhere- in the system.
If I get 10 free hours of tech support from a vendor, and I use all of that up as the result of an attack, you're damn right I should be compensated.
Fixing the security hole yourself is a big no-no
Apparently you're under the delusion that all corporate environments are using Linux on all of their mission-critical systems.
For those of us in the real world, we have to wait for vendor patches and upgrades, or we have to implement workarounds. Fortunately, major vendors tend to be quite helpful in emergency situations like this.
Practice Paranoia:
Don't go anywhere near the internet or any network
of any kind, they are the devil
Chances are you got a virus, if you see a screen
popup that has a window on it and displays the word Windows 9x
Turn your computer off ppl are probably looking at
your 'leet files right now
Remember hackers are tricky; even if you don't
have an internet connection and your
computer is off there is still a chance that
they could be screwing with your system
right now, better just set on it fire with
gasoline and a flame thrower
Finally, kill everybody, you gotta be thorough
It's an ILLEGAL INTRUSION.
If you want to break into systems to learn how security works, be able to examine code, etc., GO TO COLLEGE. Most universities have some very EXCELLENT network security courses where the students do precisely this, and have access to all sorts of very interesting hardware. Do not use my systems for your stupid games or "education", whatever it is you want to call it. How am I supposed to know you didn't touch anything vital? If you break into a bank vault just to "learn", and the cops come to your house the next morning, do you think they're going to care or believe you if you said, "But I didn't take any money!"
And just because a system isn't 100% impenetrable to your l33t hax0r skilLZ does not necessarily mean the admin is remotely incompetant. What if the exploit was made available before an announcement/fix/workaround was made? What if both were released at 3AM? Is the admin incompetant because his pager isn't set to wake him up every time an e-mail message is posted to Bugtraq? Is the company *deserving* of an attack just because they don't spend 80% of their meager revenue on network security?
If you break into my system illegally, REGARDLESS of your intentions, I will prosecute you and you will go to jail. Period.
so basically the cost of security checks, which should have been done BEFORE ever running a server.
It's like catching a thief with jewelry outside a store which locks its cases. It's expensive to repair any damaged cases, have a locksmith examine the locks for damage, repair damaged locks, replace any locks which are of a type which is now known to be easy for a lock picker, have a consultant recommend theft alarm possibilities, have an architect recommend security changes for exits, pay the higher insurance premiums, everyone in the area gets a little higher tax rate because the police were a little busier that day and manpower costs increase...
Hell, I can't write C worth a crap, and I could take down much of the internet in only *TEN MINUTES.*
All I'd need is a backhoe.
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know
Well, anyone who gets their "news" from TV is ignorant, in the truest sense of the word. Unfortunately, that is most people today.
DO NOT DISTURB THE SE
Either out of ego, evil, or error,
(take that J.J.!) someone will try it
and we'll have a crisis for a few days.
Its human nature.
While I am not privy to the L0pht's plans, it is not too hard to imagine a scenario that would take down the Internet. Think of an exploitable bug in BGP4 that would allow you to poison the routing table or a self-propagating virus for Cisco IOS. If you take out all the Cisco gear, or find a way to more or less break BGP4, the Internet would pretty much go poof.
I did not see either program, but I did read the summaries. When they said that the members of the L0pht have the ability to break into systems, what they somehow neglected to mention was that they get *PAID* to do this as part of a security audit! There has never been any indication that members of the L0pht go around randomly cracking machines.
I expect we'll see more of these in these last couple weeks of life. If Russia's nukes don't go off and burn over New York, Chicago, California, the end of the world is bound to come via 14yr olds shutting down everything.
A few things in the 20/20 piece struck me as odd. First, the head punk of this Global Hell didn't come across as anything more than your average script kiddie. He basically just cracks into places because he's bored. One thing he said in the very beginning was that he loves his computer more than "anything in the world." Not his mom (there was no dad in the interview, hmm), or anything of real importance, but an electronic box. This is the first stage in social disorders like this.
Then he got his computer taken away in a police raid, and what happens? His mother, seeking nothing but making the boy happy, goes out and buys another one the next day. No discipline or anything, but "Oh honey, here's a new computer. Will you love me now?" Now in my day, the parents would have thrown a fit over the police raiding our house and I wouldn't get out of the dungeon for weeks. Has anything changed in just ten years since I was a teen, or was it because my parents didn't need to try so hard for the kids to like them?
Then there was that goofball at the American Retirement Company or whatever saying he's hired this guy as a "consultant" to prevent him from sicking all the other kiddies on the company. Wasn't there some law back when the mob did these things which made it just as illegal to pay off these sort of extortionists?
One funny part in it was when they talked about the virus due to explode next year. They said it was spread by Microsoft's email program. Sounds to me the way to cure that is to not use MS Outlook.
Oh. And I have just lost $500,000 typing this post using the media's magical calculator.
I wasn't suggesting a 'Trashing the Internet HOWTO' (or would it be a mini-HOWTO because it only takes 30 minutes :) )
My point was that the reporter took no steps to verify their (your?) claims. Even if the boasts aren't far-fetched, it's reporting like this that spread confusion and panic.
I remember reading about one of the first high-profile hacker busts (was it Mitnick?) that said the prison officials wouldn't let him use the phone while he was in jail because everyone thought he could make one call and start a nuclear war.
When the general public becomes misinformed, it gives the government excuses to pass regulatory laws. If thousands of average at-work net surfers read the article and start worrying that every 14 year old kid who owns a computer and wears glasses can destroy the internet, the government will helpfully pass all sorts of laws to limit use and what not.
Won't happen? Remember all the stories about Geek Profiling and metal detectors in schools? Youth violence has plummeted since the early 90s and is still falling, but thanks to the media, people *percieve* that kids [esp. geek kids] are getting more and more violent so school officials can now get away with expelling people for playing Quake.
I guess a summary of my point is: Lousy reporting has really annoying consequences.
Dana
Many people "in the scene" refer to it as hacking. They refer to the reverse engineering of software as 'cracking.' Emmanuel Goldstien (sp?), editor of 2600 refered to the effort to call malicious hackers 'crackers' "misguided." So yes, 'hacker' is the appropriate word. I think that the whole 'hacker' vs 'cracker' debate is about as dumb as the 'geek' vs 'nerd' debate...
"If you deface a Web site of a company that is making $18 million dollars a day, you are committing a pretty serious crime,"
:)
Can no one who has commented on this posting READ? No where does it say that it is a website making '$18 million a day'. It says, rather plainly, that the company is making $18 million (via whatever means they do it) a day, and the hackers are defacing that particular company's web site. They're not trying to say that the website is making $18 million.
Geeze... Get real. Go back to your English classes: "..that is making..." referrs to "..a company..", not "..a Web site..".
What?
If you wanted to render a population incommunicado -- that is, a large-enough and spread-out-enough population so that cutting the power, the links, and jamming any packet-radio frequencies wouldn't be feasible -- then that's one of the targets you'd want to add to the list, along with the phone exchanges. If you wanted to prevent ANY messages being sent -- including one-way -- you'd also have to stop radio / TV broadcasts as well, of course.
{shrug}
Might be useful if you want to cause sufficient confusion and distraction to increase your odds of getting away with a random terrorist act -- or impose martial law (choose your conspiracy at will. {shrug} Feh.). Alternately, if somebody's an utter punk who seeks naught but notoriety, this would definitely do it. Why? There are a few billion people in the world; a goodly number are twisted enough to consider something like this. Most don't have the means, yet.
As for practicality... there was an incident involving the "Florida Interent Exchange" (a small ISP) claiming via BGP that it was the best route for a rather large portion of the world, resulting in a bit of chaos for hours -- and that was just an accidental misconfiguration at a single site, not sabotage. Getting multiple routers to do something like that simultaneously could cause some significant issues, unless BGP's been rejected or fixed.
Only the dead have seen the end of war.
ABC didn't even have to hire someone to ask questions. We have a large IS department, and some of us even have a clue (Unlike the reporters). We heard about the story on Friday
-p
Make affiliate bucks
Melissa's a good beginning example to show the weakness of the internet, but all Melissa did was become a "cholesterol," if it were, to the "arteries" of the internet. Once it was cleaned out, everything got back up and running.
h tm.
As it was suggested, I did some looking into BGP, because quite frankly, it'd be pathetic for me to blabber on about something that I didn't understand. The only problem is, you need a pretty good understanding of IP to understand how BGP works, and there isn't much documentation out there that sums it up in a dime. Here's the easiest explination I can get for how BGP works (the whole document that goes in to far greater detail can be found at http://www.netaxs.com/~freedman/bgp.html) :
The primary purpose of BGP4 (as we're studying it here) is to advertise routes to other networks ("Autonomous Systems").
An AS, or Autonomous System, is a way of referring to "someone's network". That network could be yours; a friend's; MCI's; Sprintlink's; or anyone's. Normally an AS will have someone or ones responsible for it (a point of contact, typically called a NOC, or Network Operations Center) and one or multiple "border routers" (where routers in that AS peer and exchange routes with other ASs), as well as a simple or complicated internal routing scheme so that every router in that AS knows how to get to every other router and destination within that AS.
Layman's terms: Every personal network out there (company networks, school networks, government networks) works in it's own little private world. BGP (BGP4 is just the current version of BGP) is the protocol (acronym stands for Border Gateway Protocol) that allows all these networks to talk to each other. The protocol is utilized by Cisco's routers, and since Cisco currently has the majority share of internet routers currently in use, if l0pht (or anyone else who knows how to do it) creates specific scripts that break these bonds between the network, the majority, not all the internet, but the good majority of it, will fall like the giant it is.
How can you bring it down? Well, due to my ignorance, I'm not completely sure, but I believe the web site I quoted earlier sheds some light on it:
When you "advertise" routes to other entities (ASs), one way of thinking of those route "advertisements" is as "promises" to carry data to the IP space represented in the route being advertised. For example, if you advertise 192.204.4.0/24 (the "Class C" starting at 192.204.4.0 and ending at 192.204.4.255), you promise that if someone sends you data destined for any address in 192.204.4.0/24, you know how to carry that data to its ultimate destination. The cardinal sin of BGP routing is advertising routes that you don't know how to get to. This is called "black-holing" someone - because if you advertise, or promise to carry data to, some part of the IP space that is owned by someone else, and that advertisement is more specific than the one made by the owner of that IP space, all of the data on the Internet destined for the black-holed IP space will flow to your border router. Needless to say, this makes that address space "disconnected from the 'net" for the provider that owns the space, and makes many people unhappy...Anyway, the bottom line: Test your configs and watch out for typos. Think everything that you do through in terms of how it could screw up.
Layman's terms: Say someone wanted to shop at Amazon.com. Their computer says "take me to Amazon.com". If my computer saw the request "take me to Amazon.com," and I wanted to stop the request, I could say "Sure, I know where it is... follow me!" Then I'd lead him to a cliff edge and tell him it's right over the cliff. Poof, end of request. If I wanted my computer to direct everyone who asked for Amazon.com to someplace OTHER than Amazon.com, I'd just stick an arrow sign by the cliff that said "Amazon.com -->", directing them over the cliff.
Even Lamer Layman's terms: remember the good old Looney Toons cartoons where Wil'E'Coyote would repaint the road and dashed-yellow line, directing it to the face of a cliff? If the Road Runner was a packet of information traveling pretty fast on a network (the roads), and you "tweaked" the network and told it that this new route (repainted road) went somewhere, when infact it ends abruptly (cliff wall), you're going to loose the information (aka "SPLAT!").
For man with no mind: "Oh, you want to know where New York is? Try looking in Russia."
Another place that explains the BGP protocol and actually makes the technicalities of it easier to understand (diagrams and simple numbers), the address is http://www.alliancedatacom.com/cisco-bgp-routing.
You come in one day and find your site defaced. Oh well, that's no big deal - you and Robin both know that all these costs of recovery are exaggerated. You'll restore index.html from the backup, smile at a job well done, and go home.
Meanwhile, since I've trojaned telnet, ftp, and ssh, I'll have every password on your server (not that it matters, since you never bothered to fix the root shell exploit I compromised in the first place); the new ftp server I've installed will do a great job of distributing warez and MP3s to all my leet friends; and the backdoor I've put in place will mean that I'll own your entire network sometime when I get bored.
Oh, please say you'll take your expertise and put it to work for me!
'Hackers' attack Major WebSite
<?php
$a[] = "Young cyber whizzes with knowledge to infiltrate the most secure computer systems in the world are growing in numbers and ability.";
$a[] = "Faced with growing security threats to government and commercial Web sites, the Justice Department is no longer sitting by idly.";
$b[] = "Brian Ross takes a look at some members of "Global Hell," an online gang of several dozen of the most active and notorious teenage computer hackers on the Net, and the FBI's efforts to delete these hackers from cyberspace.";
$b[] = "\"I don't understand why they look at us as such bad people,\" 19-year-old Patrick Gregory says. Gregory is the one of Global Hell's founders.";
$b[] = "\"We can't treat this problem as if it's just kids. Everyone has to start taking this very seriously.\"";
$c[] = "\"If they penetrate a computer system with intent to defraud, or the intent to sabotage it or, or to steal proprietary information, yes, that's a federal crime\"";
$c[] = "\"That's correct,\" one L0pht member responded. "It would definitely take a few days for people to figure out what was going on.\"";
$c[] = "\"Well, if we can find it,\" says Space Rogue of the L0pht, \"somebody else can find it.\"";
srand( ((double)microtime())*1000000.0 );
for ($i = 0; $i < 5; $i++)
echo $a[rand(0, count($left)-1)] . " "
. $b[rand(0, count($cent)-1)] . " "
. $c[rand(0, count($righ)-1)] . " "
;
?>
(using patented StoryCreationTM technology in use at over 50 different media outlets)
Please read the post this is attached too. Notice it is currently marked as "insightful", when the post contains incorrect (and slanderous) information. Please find the facts at L0pht's site and make amends.
Say you can shut down the Internet for a prolonged period of time. What purpose would that serve? What has the "Internet" community done more harm than good any group of people? (I've seen almost EVERY minority/majority use the Internet to spread their word. Its cheap, annoymous, use almost any media (pictures/words) and can reach a worldwide audience.)
Could you imagine the amount of pressure law-enforcement departments would have to capture those responsible? Could you imagine the laws that would be enforced/enacted to prevent this thing from occuring again? Could you imagine the BigBrother mechinicms then put into place?
Wouldn't this be a BIG step backwards for the Internet?
And what would it prove? Is it worth it?
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
"Because of the growing threat of cyberterrorism, the federal government has committed more than a billion dollars to go after computer hackers" Quoted from the 20/20 Article. I wonder how much of that money is spent on securing web sites, instead of putting 18 year old hackers in jail.
As noted in previous discussions, no sysadmin worth the name is simply going to restore-and-forget. Any that would? Fire 'em.
They're probably counting the costs of the full security audit, including lost business due to downtime -- since it's a BAD idea to not bring the system down for a full check if some loser's obtained root access. At the very least, one needs to eliminate the possibility of remaining backdoors (probably a full re-install if possible), lock it down, and preferably try to figure out the points of entry and anything, such as database records, that may have been affected.
Only the dead have seen the end of war.
Another overblown story to make people fear the internet and computers.
-M
You know, if a group of physicists really put their minds to it, they could devise a way to vaporize the entire planet in a millisecond. I guess that makes them brilliant. If I tell the world how to do it I am just a bad guy enabling malicious evil scientists. If I don't tell the world I am just a clueless boaster.
:-) Things never work like they're supposed to, but if this DOES work, you risk destroying your lab equipment, your house, Earth, the sun and eight other planets, Proxima Centauri, and roasting any planets that happen to be orbiting nearby stars. But you'll prove to everybody how smart you are by demonstrating a serious flaw in the existing version of our universe.
If anyone is seriously interested in this topic, I suggest studying up on M-theory, and pay close attention to the energy potential regarding De Sitter space. Then you just have to spend some long nights experimenting with the correct particle interactions (use your own equipment, of course) until you finally create your own Type 1A supernova explosion.
If you don't want to do all that work yourself you are going to have to trust me.
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know
Gack.
We did not go into details about taking down the net in 30 minutes because we don't all need another script kiddie attack. See we can't win. If we tell the world how to do it we are just bad guys enabling malicious hackers. If we don't tell the world we are just clueless boasters. If anyone is seriously interested in this topic I suggest learning the BGP routing protocol paying close attention to the authentications mechanisms or lack thereof. Then study the network topology of the backbone provider interconnection points (the NAPs and MAEs). Then learn how to craft your own packets with a library like libnet. Then do some long nights of experimenting (on your own equipments of course). If you don't want to do all that work yourself you are going to have to trust us. :-) Remember, things never work like they are supposed to. If they did there wouldn't be nearly so much hacking! weld@l0pht.com
Why hasn't anyone done a story about the "good" hackers out there? The ones that simply crack a site and leave a note for the admin about how to tighten their security. Those guys SAVE the company a fortune. Rather than having to hire some BS company to examine their system, some little scriptkiddie comes along and does it for them. I think that more than makes up for a few defaced web pages (which really didnt cost anywhere near that much to replace).
=======
There was never a genius without a tincture of madness.
After the recent news, ABC isn't one you want to say doesn't have influence. :) From the John Cochran dinner with old chum Algore, to the staged McCain/Bradley handshake. They're in the business of pushing what helps them get viewers. And, we all know the end of the world is near, so people will watch and see how kiddies will break into their computer come Jan 1. Hype + hippie liberals = News.
Among all the hacker vs. cracker comments here, I might have missed something, but did anyone else notice the end of the 20/20 article? The article was about hacking & cracking, but the tips they gave at the end were about viruses! I can understand the media's (ongoing) hacking/cracking confusion, but can't they tell the difference between that and a virus?!
Note: the "you" in this post is a general "you" and not a reference to the original poster or any other poster in this thread.
Whether it is $5/day or $18 million/day, the fact remains that people who hack other people's computers are violating others. There is no justification for that. Getting into an argument over exactly how much it costs takes away from that fact.
Here are the general reasons I here cracker dorks and script kiddies give for their asshole behavior:
Bullshit. If you wanted to do them a service, you would email the sys admin the hole being exploited. Breaking into their web site is, at best, a way of publically damaging the reputation of the web site in question as well as doing damage that can range from inconvenience to, yes, millions of dollars a day. It is very similar to breaking into your neighbours house and spray painting the walls because they forgot to lock the front door. Finally, it is very difficult to secure an NT or a UNIX machine. Punishing people because they are not the experts you think you are (but likely are not) is pathetic.
And that makes it OK? I don't care if it is Microsoft, it is still just as wrong as doing it to an individual.
Again, so what? That does not make the act of breaking into a web site any more justified.
It always costs them something. It may not be $18 million/day. It may be giving up a weekend after having worked a month without getting a weekend. It may not be anything you value at all. But it is certainly something valued by someone associated with the target site. And no one has any right to force that person to incur that cost.
The whole debate is silly and disturbing. First of all, there are racist conotations. As we all know, a cracker is a poor white person, and the stereotype of a computer security enthusiast is that of a white male. Additionally, you could consider breaking into a machine as some sort of redistribution of wealth (wealth being measured in terms of access to computers here)... I don't think the cracker/cracker thing is a coincidence. Also, why all the fuss about calling someone who is generally dedicated to computers a "hacker?" Just because the area of computing they dedicate themselves to happens to be questionable in some people's eyes, doesn't make them any less then anybody else or even very different. Please note, I'm not talking about script kiddies, as they do not matter. Not all of the people who break into computers are script kiddies.
Come now, you aren't putting on your offical media paranoia cap.
These people do nothing less than completely shutting down the Dept of Defense, Pentagon, and every nuclear sub. I mean, what else is there besides web sites and email? And they don't stop at government agencies. Every bank in the world has been cracked and now every cracker knows you withdrew $20 on June 16th at 5:03pm at the ATM next to WalMart. With this sort of information, they will withdraw all your money from your account and spend it on more computers.
Why, with these sort of tools, they could crack into the stop lights at some major intersection, turning them all red, causing traffic jams 100 miles long as no one knows better than to just go.
You see, this January is going to be some serious business. And the only way out is to stockpile propane and cheese whiz in the bunker, never to emerge until March.
Yea I love that. As someone that tests software and has worked on security tools, I know first hand that so much of the software out there is poop.
I suppose they might be "cyber whizzez" considering...
1> The numerous bugs in security software
2> Poor if any implemntation
3> Lack of properly trained personel
4> Lack of any site monitoring
5> Millions of nodes on the net. The laws of probability alone is in thier favor.
6> Some people just never learn. Why is it the same sites again and again get hacked into?
etc.....
I mean, come on. Does ABC really have that much influence on legislators? 20/20 is nothing more than a video tabloid and World News Tonight ought to be renamed "Weekly World News Tonight - Now In Full Colour!" or something sensationalist along those lines. Oh, I hear you. "But, Count Spatula, people really do take notice of programs like this one, and politicians get their cues from these newscasters!" Drek. The people who take these programs seriously also think their cats are actually their children and buy the Enquirer because "Elvis isn't really dead, just hiding in Poughkeepsie". As far as politicians go, the more criminalization that occurs, the better. It makes them look good at election time.
-- Count Spatula: The Culinary Vampire "...because my cooking sucks."
> Also, the Web site is just brochureware, there is no gateway to anything important.
That's starting to change. Remember the web pages of three years ago? Hi! We're here! We sell stuff! Visit us in the real world! Nothing more than a billboard on the side of the highway. Now corporations are starting to use their webpages for something useful.
But brochureware is going down the wayside. What we REALLY need right now is one of the self-proclaimed "e-commerce" commanies to build a real online store app for mom and pop. (Or a rentable service.) Of course, it would also make a REALLY USEFUL open source project.
But as we get away from brochureware, boy, it is going to be Christmas time for the crackers.
I saw this last night but couldn't submit a link since 20/20 was inaccessible.
It was ridiculous.
I got the impression that those kids threatened ABC so they could spend sometime grandstanding.
Every single person who spoke sounded like a complete idiot. Cripes, the White House might have secure internal systems, but cracking the web site should be a trivial task. When it was done, the site was probably being run by a secretary using NT. [Point, Click, white-out]
.....20/20 can explain how easy it is to (h)crack just such a million dollar article about (h)cracking to point a helpless, unsuspecting populace under attack by the sadistic, evil (h)crackers who want people to think that anti-virus software available from will protect them from "The Evil People With Odd Names" who have already (h)cracked the anti-virus website (since it is sooooooo easy-to-do, remember? We already reported that. Did we mention that our article, and the anti-virus webpages are worth one million smackers? And they are so big, they take a whole day to upload. And they're state of the art, we use MS Word 2000 and MS Frontpage so they're good.) to trick you into hacking your own PC so that they can look at your sweet, virginal and innocent letters to Grandma in your My Documents folder. They're everywhere!
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
What was it that sysadmin said? "It cost us hundreds of thousands of dollars to reboot and repair those servers." Maybe I should hack my own site at work and tell my boss I need $300,000 to reboot the servers. Can you say new house? :)
_______
2B1ASK1
Granted, I didn't see the program(s), and I'm not a security expert... but if someone is able to break into a web site by whatever exploits, they presumably have figured out one or more username/password pairs. Since many companies would likely use these names/passwords on more than one of their machines (I know, not a very bright idea), then there would be the cost of "changing all of the locks" so to speak. Plus the costs of beefing up security to prevent it from happening again (even if "lax security" wasn't the cause of the break-in)
- Mike
The 20/20 did have an interesting proposition that one of the script kiddies responsible got hired as a consultant instead of being turned in to the Feds. The reason... the victim did not want to feel the wrath of the script kiddie after he served his jailed time.
Looks like the potential makings of a new "high tech" mafia.
If they talk about the actual cost then they are into shoplifting territory
You need a lot more to get into felony range which is what they want.
Just another perl hacker in Bangkok
Anyone who breaks into NT without ever having run it on a system must be a script kiddie. How can you know all the complicated in's and out's of a windows system without ever seeing them?
Disclaimer: These are the 2 names which come to my mind. I do not have any specific interest in using these names.
Would it not be interesting if Barnes and Noble hacked Amazon's web page and redirected their customers to BarnesAndNoble website? If you design the redirected site as a copy of Amazon, people may not even notice for quite some time, except for the guy monitoring credit card money inflow.
Has something like this already happened???
I saw that on ABC last night and read another artic le on ABCNEWS.com from and interview with L0pht saying they can take down the Internet in 30 minutes. I've thought about it and couldn't come up with anything off the top of my head. Is this a group just boasting or is there any fact to it? Wasn't the decentrailzed nature of the Internet designed to avoid going down during war and the like?
Actually multiple processors is the next big thing planned for OpenBSD now that OpenSSH is being included. And if they need multi-processors then they should learn better security practices.
"We now have a complete, secure and stable system to work from, and we're looking to tackle some large projects like SMP"
-Theo de Raadt, OpenBSD project leader
This is true. Nonetheless, attention needs to be paid to the role that poor security plays, to prevent a public overreaction. To continue with your analogy: How would you like it if, after your neighbor leaves his front door unlocked and his house is cleaned out, a police state is instituted to prevent it from happening again?
I haven't seen any real moves towards an online police state, yet. But sensationalistic articles like these that fail to mention that many of these 'hackers' are exploiting easily repaired security flaws could easily lead to a public outcry for the institution of a police state.
In all fairness, what I saw was the guy trying to show his Mom some stuff on her computer. Most moms don't run Linux.
Do You Practice Safe Computing?
Here are a few tips on keeping your computer safe from computer viruses:
Use anti-virus software and be sure regularly to update the software from the vendor's Web site.
Don't open files sent to you via e-mail from unfamiliar sources. Check with colleagues and associates before opening files they send you without notification.
Be aware of how viruses operate and watch for the telltale signs.
Don't download anything from unfamiliar Web sites.
How about these:
AOL employees will never ask for your screen name or password.
Never go into private rooms "leet" or "warez" or "coldice."
NEVER, EVER, EVER say "yes" when someone asks you to "cyber" them!!
-- BlueCalx | http://nickd.org/
What kind of hacker wouldn't have an install of the most widely used software on the net? Would he want to limit himself to being able to only break into *nix systems? Hackers need to know every operating system they can.
Slashdot never ran this article, so you can come to your own conclusion about that. This article was only on the front page of the Wall Street Journal & CNN's page. If you got nuts, you do stuff like this. Who cares about web pages? Until you break the $1 million dollar mark, I don't wanna hear anything about your "/-/aX0rin6 Sk1llZ".
... There might come a time here where I don't have time for this."
... Eventually, I don't see myself doing a lot of illegal
How an FBI Cybersleuth Busted a Hacker Ring
By JOHN SIMONS
Staff Reporter of THE WALL STREET JOURNAL
DALLAS -- In a federal courtroom here, Calvin Cantrell stands
silently, broad shoulders slouched. His lawyer reads from a short
letter he has written:
"My parents taught me good ethics, but I have departed from some of
these, lost my way sometimes," the letter states. "I was 25 and living
at home. No job, and no future. All I ever really wanted was to
work with computers."
Mr. Cantrell certainly did work with computers -- both his own, and,
surreptitiously, those of some of the largest companies in the
world. He was part of a ring of hackers that pleaded guilty here to
the most extensive illegal breach of the nation's telecommunications
infrastructure in high-tech history.
And sitting behind him in court as he was sentenced two weeks ago was
the accountant-turned-detective who caught him: Michael Morris. A
decade earlier, Mr. Morris, bored with accounting work, left a $96,000
job at Price Waterhouse and enrolled in the FBI academy, at $24,500 a
year. Mr. Cantrell's sentencing was the final act in a five-year drama
for Mr. Morris, and secured his reputation as the FBI's leading
computer gumshoe.
The tale of Mr. Morris and Mr. Cantrell is among the first cops-and-
robber stories of the New Economy, involving, among other things, the
first-ever use of an FBI "data tap." It illustrates how the nation's
law-enforcement agencies are scrambling to reinvent their profession
in a frantic effort to keep pace with brilliant and restless young
hackers.
The story also shows that hacking's potential harm is far more ominous
than theft of telephone credit-card numbers. Mr. Cantrell was part of
an eleven-member group dubbed "The Phonemasters" by the FBI. They were
all technically adept twenty-somethings expert at manipulating
computers that route telephone calls.
The hackers had gained access to telephone networks of companies
including AT&T Corp., British Telecommunications Inc., GTE Corp., MCI
WorldCom (then MCI Communications Corp.), Southwestern Bell, and
Sprint Corp. They broke into credit-reporting databases belonging to
Equifax Inc. and TRW Inc. They entered Nexis/Lexis databases and
systems of Dun & Bradstreet, court records show.
The breadth of their monkey-wrenching was staggering; at various
times, they could eavesdrop on phone calls, compromise secure
databases, and redirect communications at will. They had access to
portions of the national power grid, air-traffic-control systems and
had hacked their way into a digital cache of unpublished telephone
numbers at the White House. The FBI alleges, in evidence filed in
U.S. District Court for the Northern District of Texas, that the
Phonemasters had even conspired to break into the FBI's own National
Crime Information Center.
Unlike less-polished hackers, they often worked in stealth, and
avoided bragging about their exploits. Their ultimate goal was not
just fun, but profit. Some of the young men, says the FBI, were in the
business of selling the credit reports, criminal records, and other
data they pilfered from databases. Their customers included private
investigators, so-called information brokers and -- by way of
middlemen -- the Sicilian Mafia. According to FBI estimates, the gang
accounted for about $1.85 million in business losses.
"They could have -- temporarily at least -- crippled the national
phone network. What scares me the most is that these guys, if they had
had a handler, whether criminal or state-sponsored, could have done a
lot of damage," says Mr. Morris. "They must have felt like cyber-gods."
With the exception of Mr. Cantrell, none of the defendants in the
Phonemasters case would comment on the matter. Others are thought to
remain at large. This is the story of Mr. Cantrell and two accomplices,
largely put together from federal district court records and FBI interviews.
Mr. Morris first learned of the group in August 1994, when he got a
phone call from a Dallas private investigator, saying Mr. Cantrell had
offered to sell him personal data on anyone he wished. He even offered
a price list: personal credit reports were $75; state motor-vehicle
records, $25; records from the FBI's Crime Information Center, $100.
On the menu for $500: the address or phone number of any "celebrity/
important person."
Mr. Morris immediately opened an investigation. Only 33 years old at
the time, he had taken an annual pay cut to join the FBI just five
years earlier. He had been a tax consultant at Price Waterhouse, and
despised the work. "I was young and making the big bucks, but every
morning I would think 'God, I don't want to go to work.' "
Tall, square-jawed and mustachioed, Mr. Morris began working white-collar
crimes when he arrived at the Dallas FBI field office. He took on a
few hacker cases and realized he liked the challenge. "These guys are
not the kind who'll rob the convenience store then stare right into
the security camera," he says. "Trying to be the Sherlock Holmes of
the Internet is hard when the fingerprints on the window can be so
easily erased."
Mr. Morris convinced the private investigator to meet with Mr. Cantrell
while wearing an audio taping device. After reviewing the tapes, he
was certain that he was onto something big. He applied for and received
court authority to place a digital number recorder on Mr. Cantrell's
phone lines, which would log numbers of all outgoing calls. It showed
that Mr. Cantrell frequently dialed corporate telephone numbers for
AT&T, GTE, MCI, Southwestern Bell and Sprint. Mr. Cantrell had also
placed calls to two unlisted numbers at the White House, which further
piqued Mr. Morris's interest.
So, late that summer, Mr. Morris took an unprecedented step. He began
writing a 40-page letter to the FBI's Washington headquarters, the
Department of Justice and the federal district court in Dallas. Recording
Mr. Cantrell -- now his central suspect -- while on the phone wasn't
sufficient for the job that faced him, he believed. Instead, he needed
new federal powers. He asked for Washington's permission to intercept
the impulses that traveled along Mr. Cantrell's phone line as he was
using his computer and modem.
"It's one of the hardest techniques to get approved, partly because it's
so intrusive," says Mr. Morris, who spent the next month or so consult-
ing with federal authorities. "The public citizen in me appreciates
that," he says. Still, the long wait was frustrating. "It took a lot
of educating federal attorneys," he says.
Once authorities said yes, Mr. Morris faced another obstacle: The
equipment he needed didn't exist within the FBI. Federal investigators
had experimented with a so-called data-intercept device only once
before in a New York hacker case a year earlier. It had failed miserably.
Mr. Morris and technicians at the FBI's engineering lab in Quantico,
Va., worked together to draft the specifications for the device Mr.
Morris wanted. It would need to do the reverse of what a computer's
modem does. A modem takes digital data from a computer and translates
it to analog signals that can be sent via phone lines. Mr. Morris's
device would intercept the analog signals on Mr. Cantrell's phone line
and convert those impulses back to digital signals so the FBI's
computers could capture and record each of a suspect's keystrokes.
While waiting for the FBI to fit him with the proper gear, Mr. Morris
contacted several of the telephone companies to alert them that they
had been victimized. The reception he got wasn't always warm. "It's
kind of sad. Some of the companies, when you told them they'd had an
intrusion, would actually argue with you," he said.
GTE was an exception. Mr. Morris discovered that Bill Oswald, a GTE
corporate investigator, had opened his own Phonemasters probe. Mr.
Oswald and Mr. Morris began working together and uncovered another of
Mr. Cantrell's schemes: He and some friends had managed to get their
hands on some telephone numbers for FBI field offices. They entered
the telephone system and forwarded some of those FBI telephones to
phone-sex chat lines in Germany, Moldavia and Hong Kong. As a result
of the prank, the FBI was billed for about $200,000 in illegal calls.
Mr. Morris also learned that on Oct. 11, 1994, Mr. Cantrell hacked
GTE's computer telephone "switch" in Monticeto, Calif., created a fake
telephone number and forwarded calls for that number to a sex-chat
line in Germany. The FBI isn't sure how Mr. Cantrell convinced people
to call the number, but court records show that Mr. Cantrell received
a payment of $2,200 from someone in Germany in exchange for generating
call traffic to the phone-sex service.
In early December 1994, Mr. Morris's "analog data intercept device"
finally arrived from the FBI's engineering department. It was a $70,000
prototype which Mr. Morris calls "the magic box."
On Dec. 20, Mr. Morris and other agents opened up their surveillance
in an unheated warehouse with a leaky roof. The location was ideal
because it sat between Mr. Cantrell's home and the nearest telephone
central office. Mr. Morris and nine other agents took turns overseeing
the wiretap and data intercepts. The agents often had to pull a tarp
over their workspace to keep rain from damaging the costly equipment.
As middle-class families go, the Cantrells seem exemplary. Calvin's
father, Roy, was a retired detective who had once been voted "Policeman
of the Year" in Grand Prairie, the suburb west of Dallas where they
live. His mother, Carol, taught Latin and English at Grand Prairie
High School, where Calvin graduated in 1987 with above-average
grades. As a student, he was no recluse. He had a small circle of
friends who shared his love of martial arts, video games, and spy
movies. Mr. Cantrell's longtime friend, Brandon McWhorter, says Calvin
was always a fun-loving guy, but there was one thing about which he
was very serious.
"He would always talk to me about religion," says Mr. McWhorter. "He
held very strong religious beliefs."
After high school, Mr. Cantrell continued to live at home while taking
classes at the University of Texas at Arlington and a local community
college.
He held a series of odd jobs and hired himself out as a deejay for
weddings and corporate parties. Mr. Cantrell balanced, school, work,
family and friends even as he began hacking more often. His parents
became suspicious, but said nothing. The family had three phones;
Calvin stayed on his 15 hours a day.
"They'd go in my room and see all the notes and the phone numbers.
Even though they couldn't put it together technically, they knew
something was up," says Mr. Cantrell. "They were kind of in denial. My
parents were pretty soft."
Mrs. Cantrell says Calvin had been so well behaved that she never
suspected his computer activities were more than fun and games. "I
wish I had known what was going on. Unfortunately, my son was smarter
than I was." (Calvin's father passed away last year.)
At 8:45 on the night of Dec. 21, just four days before Christmas, Mr.
Cantrell went online. Using an ill-gotten password, he entered a
Sprint Corp. computer, where he raided a database, copying more than
850 calling-card access codes and other files, court records in the
case show. The Phonemasters often got passwords and other key inform-
ation on companies in a low-tech approach called "Dumpster diving,"
raiding the trash bins of area phone firms for old technical manuals,
phone directories and other company papers. This often allowed
Mr. Cantrell to run one of his favorite ruses -- passing himself off
as a company insider.
"I'd call up and say, 'Hi, I'm Bill Edwards with systems administration.'
I'd chat with them for a while, then I'd say 'We're doing some network
checkups today. Can you log off of your computer, then tell me every
character you're typing as you log back on?' A lot of people fell for
that," Mr. Cantrell says.
After hacking into the Sprint database that evening, Mr. Cantrell
talked to another hacker, Corey Lindsley, over the phone. He'd 'met'
Mr. Lindsley, and another hacker, John Bosanac, in 1993 while surfing
the murky world of hacker bulletin boards. Mr. Cantrell then sent the
copied files to Mr. Lindsley, who was a student at the University of
Pennsylvania in Philadelphia.
Mr. Morris's equipment captured everything -- voice and data. It was
an FBI first. "We're sitting in this place that looked liked a bomb
pit, but the atmosphere was really exciting," says Mr. Morris. "We
were ecstatic."
As the days passed, the FBI wiretap generated stacks upon stacks of
audiotapes and data transcripts. Some was just idle talk among
friends, the occasional call to finalize dinner plans, lots of
workaday chatter. But the incriminating evidence mounted. "It's great,
you know. I really love fraud," joked Mr. Bosanac, a Californian who
was musing with Mr. Cantrell about the various technical methods of
using other people's cellular telephone accounts to place free
calls. "Fraud is a beautiful thing."
Family conversations even entered the investigation. On Jan. 7, for
instance, Mr. Cantrell called his mother from a friend's house and
asked her find an MCI Corp. manual on his shelf. He then asked her to
read him a set of directions for accessing MCI's V-NET computer
system. Mrs. Cantrell read the material but asked her son whether he
was supposed to have the book, citing warnings that stated its
contents were restricted to MCI employees. Mr. Cantrell just avoided
his mother's question. The FBI data-tap captured every word.
Still, the process took its toll on the FBI team, especially coming
during the holidays. "It was stressful that the wiretap was going 24
hours a day, seven days a week. I had to write up the legal documents
and it's tough making people work through Christmas," Mr. Morris
said. On top of that, he had to keep records of his findings, and
every ten days he had to reapply to the court to prove that his
wiretap was yielding evidence.
By late January, the FBI had begun to get a clear profile of Mr.
Cantrell and his hacker friends. Mr. Lindsley, it appeared, was the
group's acerbic leader, directing much of the hacking activity. Over
phone lines, the FBI heard him bragging about how he had given a
Pennsylvania police department "the pager treatment" in retaliation
for a speeding ticket he received. Mr. Lindsley had caused the police
department's telephone number to appear on thousands of pagers across
the country. The resulting flood of incoming calls, Mr. Lindsley
bragged, would surely crash the department's phone system.
They also enjoyed collecting information about film stars, musicians
and other famous people. Mr. Cantrell has admitted that he broke into
President Clinton's mother's telephone billing records in Arkansas to
obtain a list of unpublished White House numbers. The men, says the
FBI, even made harassing phone calls to rock star Courtney Love and
former child actor Danny Bonaduce using pilfered numbers.
They weren't without fear of getting caught. On the evening of Jan. 17,
for instance, there was a clicking on the phone line as Messrs. Bosanac,
Cantrell, and Lindsley shared a three-way conference call. "What the
hell happened?" asked Mr. Bosanac, according to an FBI transcript of
the conversation.
"That was the FBI tapping in," laughed Mr. Cantrell.
"Do you know how ironic that's gonna be when they play those tapes in
court?" Mr. Lindsley said. "When they play that tape in court and
they got you saying it was the FBI tapping in?"
On Jan. 18, the FBI overheard Messrs. Cantrell, Bosanac and Lindsley
on another conference call. With the other two men giving directions,
Mr. Cantrell dialed his computer into Southwestern Bell's network and
copied a database of unlisted phone numbers. The three men then
discussed plans to write a computer program that could automatically
download access codes and calling-card numbers from various telephone
systems. They also talked about the chance that the FBI would one day
track them down.
"Just remember, nobody f-- rats anybody out," said Mr. Lindsley to the
others. "No deals."
"Yeah, no deals is right," replied Mr. Bosanac.
"No deals. I'm serious. I don't care what your f-- lawyers tell you,"
said Mr. Lindsley.
Mr. Cantrell said nothing.
Later that morning, between 5:09 a.m. and 7:36 a.m., Mr. Cantrell
entered Sprint's computer system and downloaded about 850 Sprint
calling-card codes. He then transferred those codes to a man in
Canada. The codes would allow anyone who purchased them to place free
international phone calls. Mr. Morris would later learn that a contact
in Canada paid Mr. Cantrell $2 apiece for each code, court records
show. The Phonemasters most likely did not know -- or care -- where
the codes ended up, but the FBI traced them and found some ended up in
the hands of a Sicilian Mafia operative in Switzerland.
On Jan. 23, while probing a U S West telephone database, Mr. Cantrell,
Mr. Bosanac, Mr. Lindsley and others stumbled over a list of telephone
lines that were being monitored by law enforcement. On a lark, they
decided to call one of the people -- a suspected drug dealer, says
Mr. Morris -- and let him know his pager was being traced by the police.
On Jan. 27, the group was clearly feeling paranoia about being caught,
prompting Mr. Lindsley to tell his accomplices to pull as many Sprint
codes as quickly as they could. Mr. Cantrell began to have reservations.
"What if I stopped before all of y'all?" Mr. Cantrell asked Mr. Lindsley.
"Would you applaud my efforts?"
"No," said Mr. Lindsley. "I don't think there's any reason to stop.
What are you worried about?"
"Uh, I'm not worried about anything. I'm just saying, uhm. There might
He added a little later: "I, you know, really like it. But, I don't
know, I just
things."
Mr. Lindsley continued to prod Mr. Cantrell to speed up the download
of stolen codes by spending more time online and using two phones.
"I'm telling you, you run two lines around the clock," Mr. Lindsley
said.
"You can't run them around the clock," said Mr. Cantrell.
"Why not?"
"Oh, come on. I think that's pushing it too hard."
"I think you just got a weak stomach there, boy."
By late February, things began to get tense. One of Mr. Cantrell's
hacker friends informed him that his number had shown up in a database
of phone numbers being monitored by the FBI. In all the excitement of
burglarizing databases and rerouting phone calls, the Phonemasters had
neglected to check their own phone lines for any signs that law enforce-
ment might be listening in.
Mr. Morris hastily arranged for an FBI raid. On Feb. 22, 1995, agents
raided Mr. Cantrell's home, Mr. Lindsley's college dorm room, and
burst into Mr. Bosanac's bedroom in San Diego.
For Mr. Morris, the climactic raid was only the start of a long battle
to bring the hackers to justice. Because of the complicated nature of
his evidence gathering, it took him more than two years to compile the
most salient portions of the wiretap transcripts and data-tap evidence.
"All the documents and tapes from this case could fill a 20-by-20
room," Mr. Morris explains. "And at the time, I was the only computer
investigator for all of Texas."
In the meantime, as federal prosecutors slowly geared up for a trial,
Mr. Cantrell tried to get on with his life. "I spent the first few
weeks after the raid being paranoid and wondering what would happen,"
he says. Occasionally, Mr. Morris and other agents would call him,
asking questions about some of the systems he had hacked. By the
summer of 1995, at the urging of his mother, Mr. Cantrell started
attending church again. He scored the first in a string of professional
computing jobs, doing systems-administration work for a company called
Lee Datamail in Dallas. He neglected to tell his employers about the
FBI case. "It's been mental torture for the last four years, not
knowing," says Mr. Cantrell. "Can I go to school, move to another
state? That kind of thing messes with your head."
Over time, Mr. Cantrell says he had come to seriously regret what he
had done and the $9,000 he says he made from selling codes wasn't
worth the trouble. "Looking back, it was all crazy. It was an
obsession. I wanted to see how much I could conquer and a little power
went to my head." Mr. Cantrell notes that he has since tried to make
amends, even helping the phone companies plug their security holes and
helping the FBI gather more information on some of the group's members
who haven't yet been apprehended.
The matter finally seemed near conclusion this March when Mr. Morris
was able to play "a couple of choice tapes" in separate meetings with
Messrs. Cantrell, Bosanac and Lindsley. Afterward, all three agreed
to plead guilty to federal charges of one count of theft and possession
of unauthorized calling-card numbers and one count of unauthorized
access to computer systems. Chief Judge Jerry Buchmeyer ordered a
presentencing investigation.
During a hearing on the matter, Mr. Lindsley's attorney tried to argue
that the FBI had wildly overstated the $1.85 million in losses that
her client's hacking had allegedly caused. But in the end, Judge
Buchmeyer rejected the argument and sentenced him to 41 months in
prison. Mr. Bosanac, in the meantime, has asked that his sentencing
hearing be moved to San Diego, where he lives.
As for Mr. Cantrell, Judge Buchmeyer lauded his "acceptance of guilt."
He could have been sentenced to three years in federal prison; instead
he was given two. He reports to federal prison in January of next
year.
Mr. Morris, meanwhile, has used his data-tap method in several other
cases; he also travels around the country and the world advising
law-enforcement agencies on how to conduct state-of-the-art investi-
gations of hacker crimes.
And the easiest thing to make someone afraid of is something they are dependent on, but can't control or don't understand. Fear is a great hook--you're watching Friends or whatever and all of a sudden some talking heads pop up and says, "Why bottled water may be bad for you, tonight on the 11AliveCast." So you watch the 11AliveCast and they keep teasing you along until 11:26PM, when they tell you bottled water isn't fluoridated so please for ghod's sake brush.
And the next week bottled water sales are down. They really are. Air travel drops a small but significant amount after airline crashes, and boy-oh-boy do those ever grab airtime. The irony is that lots of those panickers end up driving, which is far more dangerous than flying.
Or one sociopath goes and puts cyanide in Tylenol capsules in Chicago in 1982. The press went absolutely batshit over that one, and within a month seven local poisonings became 270 copycats poisonings nationwide, and every bottle of Tylenol in the U.S. had to be taken off the shelf. Within a year all OTC pharmeceuticals were repackaged to be tamper resistant, for over $1.3 billion per year in direct costs, never mind the indirect costs of making otherwise harmless medicines impossible for elderly people to open.
Sending the population into a panic also makes governments adopt hasty, poorly thought-out measured to remedy what their citizens are convinced are terrible, terrible problems. Does anybody remember the plastic handgun scare of 1985? Huge panic, many laws passed, product did not exist and is still technologically unfeasible.
Whipping up a frenzy of concern and fear may not be responsible journalism, but it brings in readers and viewers, consequences be damned. Speaking of hasty government actions, read about W.R. Hearst's interest in the Spanish-American war some time, if you're ever curious about the lengths people have gone to to sell papers.
Moral: The manipulation of public perception can turn minor problems into major problems, not the least of which will be the public perception itself.
--
This is not my sandwich.
The only thing that the 20/20 piece did for me was determine that the true term is now 'hacker', no matter what the Slashdot community is trying to cling to. I mean, up until the end I was with you guys: I even kept on saying the word 'cracker' out loud everytime they used the word 'hacker'. But then the head of Global Hell even referred to himself as a 'hacker', and if somebody were to get the term right, it would have been him. I guess it's finally time to realize that the definition has changed with the times. After all, who wants to be called gay when they're happy (well, heterosexuals at least) anymore?
A sentence you'll never see on an Internet discussion board: "You know what? You're right."
brother. See this all the time.
My wife knows very little about l0pht, only the 3 or 4 sentances I told her about them before the interview started. After the l0pht story finished she commented that ABCnews did a crappy job explaining l0pht's purpose(s) if what I said was true. (and all I said is they're like a lab, that goes down to the hardware store, buys the dead-bolts and locks, and then runs tests on them and publishes the findings.)
I found the following quote to be fairly indicative of where the government stands: "If you deface a Web site of a company that is making $18 million dollars a day, you are committing a pretty serious crime," says Assistant U.S. Attorney Matthew Yarbrough, a member of the federal government's Cyber Crimes Task Force. Does this mean companies like McDonalds or Microsoft deserve greater protection than some mom and pop site? And what if the company is losing that much per day? If I go and fuck up Amazon.com, is that actually a GOOD think in the DoJ's eyes?
Hmm... ever since that 20/20 story, I have not been able to get to www.l0pht.com or www.hackernews.com. Have these sites, in effect, been slashdotted? Hmm... 20/20ed? Anyone else notice this?
cracking, whether it is just snooping in a person's or company's private files or something more malicious like taking down a web site or server, is a crime. it is a crime no different than breaking and entering a business or a home would be. sure it takes intelligence, skill and perseverance to crack a major site. that does not make it OK.
Ok, dad.
hmm
Those punks were Cult of the Dead Cow. And if you looked closely a lot of the computers were running NT, which is still pretty bad. Also they butchered the attrition.org defacment mirror with the Global Hell logo at the bottom. Also on the those admins that got cracked I'd list the losses as $30, the cost of buying an OpenBSD cd set, and if they are running OpenBSD then it's time to look for a new admin.
I wish I knew the specifics of costs. 20/20 seems full of BS most of the time. But as Everyone here knows data that is not backed up is in danger of being lost. Did theses hackers destroy the backup too? Sounds like whoever was breeched needs a security policy. Eric Burns..."ordered by a judge not to touch a computer for three years" I would go batty! A person with this punishment might have to resort to phreaking or maybe real terrorism.
That that Global Hell member was running Windows? And who can verify that those people really are the crackers they say they are?
Open Source, Open Standards, Open Minds
It's just not that simple. There's no doubt that most of these monetary claims are vastly exaggerated, but it's not just a matter of replacing an index.html file. If someone broke into your house and spray painted a tag on your bathroom wall, would you just shrug it off, clean it, shut your doors, and continue on with life? No. You'd beef up your security.
Fact is a lot of these sites may be "asking for it" with their poor admins and shaky security, but that doesn't make it right. If a tourist gets mugged because they're seen carrying large amounts of money is that right? If a person is wearing "suggestive" clothing and gets assaulted, is that right? These crackers are breaking the law, plain and simple, and we need to stop pointing our fingers at the victims for blame.
Even if they are stupid. It's amazing that script kiddies can even find sites to crack, I mean come on! It takes ONE mailing list to find out about these problems in advance most of the time. If their sites are worth so much money to them why can't the invest the 2-45mins each day to check this stuff out!!??
--
cracking, whether it is just snooping in a person's or company's private files or something more malicious like taking down a web site or server, is a crime.
it is a crime no different than breaking and entering a business or a home would be.
sure it takes intelligence, skill and perseverance to crack a major site. that does not make it OK.
I do believe, however, that instead of prosecuting the skillful ones, they should be taught to use their powers for good, then given jobs, not thrown in prison.
[FLAMEBAIT]
script kiddies however, should be thrashed unmercifully.
as far as the hacker/cracker thing goes, it is a lost battle. the general public does not know or care that there are different meanings. get over it and move on.
[/FLAMEBAIT]
The difference between Theory and Practice is greater in Practice than in Theory.
"I am just wondering where they keep getting these huge figures on the costs of replacing one html document with another."
Well., that simple really. There are 3 main areas of cost to the hacked company that need to be taken into account:
The 3rd point is of course the most important one, these managers can get seriously disterbed and ofton spend days away from their more productive work of playing windows solitaire.
On a more serious note, these figures tend to also include figures such as hireing security people to come in and 'beef up security', run risc assesments ecetera. The other key factor is that figures are always overstated, particaly to help with the end of year figures and also to help push law enforcement to do something about it (How good a response do you think the FBI give when you complain you lost $5?). The final issue is of course lost credability.
There are additional things to be taken into account. Companies have been known to fake hack attempts at their own websites for the exposure it gains them. I wonder if any of these hacked websites would ever be willing to declare a negative cost to the whole thing?
But I was only refering to the White House site. My kids go there often to click links and get little photos and form letters from the president and bill. Cool for kids, but useless for adults.
I think the "crackers" are out in force already on e-commerce. We just dont hear that much about it. If cracker X has expolit X and is seamlessly getting in and around some retailer with access to card info, product shipping and the revenue stream in general, he/she would never deface a page and claim "j00 i5 0wn3d" or some crap like that. They will keep it their little secret.
And the retailer will most often never even report it if the have a breech, too much bad press.
I beleive that in the March, April time frame we will start hearing a lot about how bad e-commerce got ripped off during the 1999 Christmas season. Then by the 2000 Christmas ruch it will all be a distant memory.
More race stuff in one place,
than any one place on the net.
What annoys me most about all these "hacker" stories (and most other stories too) in the news is that the reporter never ever has a friggin clue about the subject. I'm sure that l0pht and maybe GH to some extent have some legit hacking/cracking abilities, but for all I know it could just be another article glorifieing script kiddies. I bet that if ABC interviewed some random 13 year old script kiddie in place of these groups, the article would pretty much be the exact same. We'd probably read something like, "Using these advanced password cracking programs, a skilled hacker like l33tb0y13 could break into even the most secure computers in the world" or some such inane tripe.
I notice how most of the articles never really deal with the methods the crackers use. Instead what I see are quotations of the hackers boasting, and of the writer fearfully agreeing. Throw in some quotes from a paranoid and clueless law enforcement official and you got yourself an article.
I wish ABC would have hired someone who knew what he was doing to interview those "hackers." Get an authentic security expert (and not someone like Vranesevich) and have ask some technically oriented questions. I wouldn't mind seeing some big time cracker group exposed as a band of script kiddies or even seeing a real legit group's skills be verified by a competent source. As it stands, every hacker article appears to be FUD and needless paranoia written and advertised by someone who cant tell a telnet port from his ass. I want to see facts and commentary by someone who understands what he is talking about rather than seeing so many broad, unfounded statements rubber stamped and published.
Do you want a miracle or something?
... Jeez, I can't /wait/ to see what new script kiddies this has spawned.
.. A few days to notice that a website is down? PLEASE. If slashdot takes longer than 8 seconds to load, I experience withdrawl symptoms.
.... Are they legitimizing destructive behavior?" .. Jeez..
:-P
"Hackers (sic), now with their own conventions and magazines,"
Defcon 7.0, and soon 8.0. 2600 and Phrack are both > 5 years old. NOW!? These people think at the speed of a dead elephant. I'm sure they get up each day, do exactly the same thing, go to sleep, and dream exactly the same dreams they've had for the past 20 years.
I mean, I regularly seem to be probed by some script kiddie program that brute force checks phf, convert.bas, some Front Page things, etc. It's annoying, yes. Dangerous? No. If I don't securely lock and check on my building when I leave work, and don't buy a security system, I won't be insured. I wish "website insurance" would come out so adjustors could go, "Windows NT you say. How's 1,000,000 a month for a premiun?" Maybe then we'd finally see some professionalism forced past those PHBs and clueless MCSEs.
"With viruses available for downloading from the Web, extensive computer language knowledge is no longer needed." I remember having to deal with the Stoned Monkey virus in 1994 at a computer lab. It was more because clueless 12 year olds didn't know much about computers. Thankfully, the lab had a good teacher (I was just a TA checking on the machines). Professionalism is, again, a solution. Know your job, and do your job.
On to the second article..
"Their code name is "The L0pht,""
Their group name. Double moron points for showing ddd or some visual debugger at work in the image there.
"They are the elite of hackers, whose notoriety brought them before Congress a year ago."
"20/20 says hackers are reeel cool d00ds! I want to be one now!"
"That's correct," one L0pht member responded. "It would definitely take a few days for people to figure out what was going on."
"On no, the internet is down again.."
"What they do is try to break into programs we're led to believe are secure."
"But MS said that this Exchange server was mission critical, even though it doesn't have any relay protection, forces us to use LookOut!, and has many obvious holes!"
"They refer to each other by nicknames. By not revealing their real names, they protect themselves from lawsuits by companies and individuals."
They're too young to have lawsuits pressed against them.
"hey say it's to remind us how we've become reliant on computers for more than just communicating;
"Look, you rely too much on Oxygen. When I strangle you, you die! Stop relying on Oxygen so much!"
It's clear that both the reporter's poor understanding, and L0pht's annoying boasting, have contributed to bad, bad articles. Seconds to crack a password? Well, if your root password is "rootpwd," I should hope so!
---
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
so tough guy, what are you gonna do when someone breaks into your system and you cant track him down? any real hacker can compromise your system without leaving you clue to who he was.
So if the ISP looses its connection for 1hour, i can sue them for $800,000 ???
Or if the telco cuts a fibre?
Why isnt the telco equaly lyable as a hacker
If you are saying that no one cares about the diff
of hacker-cracker, you are out of it.
Last month when I told my son that I had to "hack"
some code, he got *very upset*. I had to explain to
him the difference. There is one and the diff does
matter.
A better analogy would be that they go out and pick locks on other people's houses or cars, but then instead of stealing anything, they hang a big sign on the door saying "Company X builds sh*tty locks, see?"
I'll be the first one to admit, the companies whose executives use their first names as passwords deserve to be publically embarrassed when they determine security policies and methods without knowing anything about the subject, but even the more benign hackers are not exactly Consumer Reports. They do not "buy" the locks, they test other people's.
The most disturbing thing about the two stories is the fact that the U.S. Attorney wonk they interviewed basically implied that the richer the person you mess with, the more serious the crime: "If you deface a Web site of a company that is making $18 million dollars a day, you are committing a pretty serious crime," says Assistant U.S. Attorney Matthew Yarbrough
[command INSERTWITTYQUIP failed: insufficient wit]
Remember that at the end of the year the amount and quality of news is significantly less that any time during the rest of the calendar year. That is why there are so many "scary" Y2K stories and now Cracker/Hacker stories. The News departments know that most people that continue to watch these news/entertainment prime-time programs are middle-class 35-60 Americans w/kids that don't understand the Internet and if they do they think it starts with "You've got mail!!". It is sad when journalist enlist attention starved individuals (so called Crackers) to make a segment of productive, hard working people (Hackers but I hate that word) look bad.