🚀 go-pugleaf

Forwarded from  comp.internet.net-happenings:

> From: John Walker [mailto:jwalker@networx.on.ca]
> Sent: Wednesday, August 25, 1999 1:49 AM
> 
> Is China preparing a cyber attack to coincide with the expected
> Y2K problems at the end of the year?
> 
> A special report coming soon...
> 
> ------------
> Hackers scanning for trouble (Canada)
> 
> By Bob Sullivan, MSNBC
> August 24, 1999 5:38 AM PT
> http://www.zdnet.com/filters/printerfriendly/0,6061,2319298-2,00.html
> 
> Dragos Ruiu was just minding his own business, a Vancouver software
> startup, when it started. Day after day, relentlessly, someone or
> some group out there on the Internet is banging away at his servers,
> sneaking in and gaining full access. A security expert, he knows
> what's happening: He's being probed. Is this mere sport, or a
> "casing," like a bank robber who visits the bank several times to
> study its security systems before the heist?
> 
> Every day they come, they lurk -- then they leave without doing
> damage. And Ruiu is powerless to stop it. Every method he has tried,
> they have trumped. They're toying with him. "They must feel like
> gods," he says.
> 
> They come at him through clients' computers, through Canadian ISPs,
> once even through one of the largest Canadian banks. They hack into
> Linux boxes, NT boxes, Unix boxes. Hack by day or night. No matter.
> 
> And all for no apparent reason. They look, but don't touch.
> 
> Ah, the life of a network administrator these days. There are
> thousands of ways to break into a computer, and there are now
> several downloadable software packages designed to scan the Internet
> for Web sites and servers that have just one flaw.
> 
> According to Peter Tippett at computer security research firm ICSA,
> a new box connected to the Net will almost certainly be "scanned"
> before one week goes by. And the amount of scanning activity has
> doubled in the past six months.
> 
> That's about when the scanning started for Brandon Pepelea, a former
> employee at PSINet who says his collection of Web sites has been
> scanned systematically several times a week since January. In
> another example of a victimless probe, Pepelea thinks someone or
> something has been banging through all the Internet addresses between
> 38.240.x.x and 38.200.x.x, a so-called Class-B range of addresses
> that constitute about 16,000 possible computers.
> 
> ZDTV VIDEO:
> 
> Snooping made easier for hackers
> 
> In his case, the scans were unsuccessful. Whoever or whatever it is,
> they haven't been able to break into Pepelea's computers. Still, the
> relentless, systematic nature of the probe has him spooked. He's
> been demanding that PSINet, which owns all the addresses in the
> 38.x.x.x range, chase down the scanner and prosecute.
> 
> "I don't think they understand how serious it is," Pepelea said.
> "The threat not so much being the nature of the scan but the scope of
> the scan... If you're between 38.240 and 38.200 you've had the scans.
> They've walked through and gotten to you."
> 
> Nose for trouble
> 
> The attack itself involves use of the Simple Network Management
> Protocol, frequently used on network routers. Pepelea owns machines
> between the 38.240 and 38.200 address range, and concluded scans
> spanned that range by studying patterns of hits to his own and his
> client's machines.
> 
> This is not the first time Pepelea, now CEO of a small security
> company he calls "Designer's Dream," has done a hefty amount of
> personal cybersleuthing. Last December, he compiled information on a
> virus writer named VicodinES, and shared it with the FBI, the CIA
> and other law enforcement agencies. His tips fell on deaf ears, and
> VicodinES, who the world now knows as Dave Smith, went on to release
> the Melissa virus. Pepelea's hell bent on being heard this time
> around. "Once again, nobody cares," he laments.
> 
> PSINet said early last week the scans were being generated by an
> account serviced by the company, and that it had dealt with the
> matter by canceling the account. But by Friday, the company had
> canceled three more accounts in an effort to stop the probes. While
> officials there say they take the matter seriously, they are not
> convinced it's an organized hacker attack.
> 
> "It's not possible to characterize whether this is a mistake, a
> malicious event, was planned, or it just happened," said Cole Libby,
> Director of Network Engineering. For example, it could a wrongly
> configured piece of hardware searching a section of the Internet for
> a new printer. "There are lots of examples of technology out of
> control in the world."
> 
> No harm, no foul?
> 
> Scanning, the cyberspace equivalent of walking down Main Street and
> jiggling handles to see who leaves the front door unlocked, brings
> up murky legal issues. Entering someone else's computer is illegal,
> but scanning, which amounts to asking a computer how it's been set
> up, probably isn't. Pepelea says PSINet told him to pursue legal
> action against his cyberpest -- but for what? Meanwhile, Pepelea
> thinks PSINet should be liable if any real trouble ever comes from
> his suspected hacker, particularly since the Net provider was warned.
> 
> That's not likely, says Internet law expert Dorsey Morrow. PSINet
> would almost certainly face no criminal liability for the actions of
> a hacker on their network, and wouldn't likely face civil liability
> either.
> 
> "As long as they can show 'We were doing everything we can. We've
> got security policies in place. We're using the latest software.'
> That mounts up to a pretty good defense," Morrow said.
> 
> So there's no consequences for scanning, either to the hacker or the
> company that provides the means. But what of Ruiu's hackers, who go
> just one step further than Pepelea's scanners? They scan, then
> enter, lurk around, and leave. Dancing tantalizingly over the edge of
> the law, they show an ability to do far more damage.
> 
> Their methods are painstakingly deliberate, designed to avoid
> detection. They launch attacks from multiple sites, sometimes
> sending no more than a packet per day from any site, in order to hide
> the kind of suspicious activity protective "sniffer" programs look
> for.
> 
> "We saw one new machine coming at us every five minutes," Ruiu said.
> "They must have felt like gods because they could break into any
> machine they wanted."
> 
> That includes a collection of Canadian ISPs, and even one major
> Canadian bank, the hackers broke into. When he called, Ruiu often
> had a tough time convincing victimized ISP administrators they'd been
> hacked.
> 
> "The reaction of ISPs was disbelief," he said. "One didn't believe
> us until a marketing guy had his laptop taken out and it started
> sending weird packets."
> 
> Ruiu is convinced the hacks are coming from a coordinated team,
> because of their speed and variety. But while the cat-and-mouse game
> continues, he can only speculate on motive. His company, a 15-person
> startup called Netsentry.net, is hardly a big target. So Ruiu thinks
> his outside efforts in the security community are likely to blame.
> He recently worked on project called "Trinux," which aimed to create
> a security-enhanced version of Linux that fits on one floppy disk.
> Among his partners was Ken Williams, who until recently ran Packet
> Storm Security, perhaps the most popular reference site in the hacker
> community.
> 
> "I suspect these guys are targeting security software," he said, but
> added they have not revealed their intentions. "This is really
> bugging me. The lack of a motive really disturbs me�it gave me the
> creeps."
> 
> The attacks have also been humbling for Ruiu, who has spent a lot of
> time chasing the hackers when he could be working to get his
> business off the ground.
> 
> "There are a lot of assumptions we're all making about Internet
> security that we shouldn't," he said. "There's a lot of things we
> don't know."
> 
> For example, these hackers made a habit of hijacking machines Ruiu's
> computers normally talked to, then initiated attacks from these
> supposedly "friendly" computers. That made them almost impossible to
> detect.
> 
> "If they get a machine that's close to your machine, that's almost
> as bad as taking over your Web server. It's a great place to launch
> an attack on your firewall," he said.
> 
> Nothing about Ruiu or Pepelea's stories surprised ICSA's Tippett,
> who expects security problems to get worse before they get better.
> 
> "It's the wild, wild West out there," he said. "The tools are
> pervasive and so common. The chance of getting caught is pretty
> slim� Our neighbors are now very close and enough of them don't have
> a great social conscience."
> 
> A more extensive report on the one of these attacks, written by
> Ruiu, can be found at www.securityfocus.com .
> 
> --------------
> On-line Learning Series of Courses
> http://www.bestnet.org/~jwalker/course.htm
> 
> Member: Association for International Business
> -------------------------------
> 
> Excerpt from CSS Internet News (tm)  ,-~~-.____
> For subscription details email      / |  '     \
> jwalker@hwcn.org with              (   )        0
> SUBINFO CSSINEWS in the             \_/-, ,----'
> subject line.                          ====           //
>                                        /  \-'~;    /~~~(O)
> "On the Internet no one               /  __/~|   /       |
> knows you're a dog"                 =(  _____| (_________|
> 
> http://www.bestnet.org/~jwalker
> 


--
####    |\^/|     Colin R. Leech     ag414 or crleech@freenet.carleton.ca
#### _|\|   |/|_  Civil engineer by training, transport planner by choice.
#### >         <  Opinions are my own. You may consider them shareware.
####  >_./|\._<   "If you can't return a favour, pass it on." - A.L. Brown