.pt zine - Noticias

Noticias:
-------------
by secretos

envia as noticias que aches interessantes para secretos@kaotik.complex-x.net

17/10/97

`IN: BUGTRAQ@NETSPACE.ORG`
From: Aleph One <aleph1@DFW.NET>
Subject: Security Hole in Explorer 4.0

http://www.jabadoo.de/press/ie4_us.html

Security Hole in Explorer 4.0

Freiburg - 10/16/97 - A dangerous security hole in Internet Explorer 4.0 was detected by Ralf Hueskes of Jabadoo Communications when he conducted a series of security tests for [3]c't computer magazine.

His tests revealed that it is possible to spy on the contents of any text and HTML files on somebody else's computer. Not only local files are in danger, but also data on your company's intranet - even if it is protected by a firewall.

The security hole exists even if users have activated the highest security level in their browser. The problem affects both the German and the English version of the Internet Explorer.

The code needed for infiltrating your files can be hidden in any normal Web page or in an e-mail message.

Technical Details

The spy pages make use of JScript. If a user accesses a page or receives an e-mail containing this code, infiltration begins ...

The spy page contains a so-called IFRAME sized 1 by 1 pixel. When a user accesses the page or opens the e-mail message, a small Jscript program loads the HTML or text file to be spied on into this frame. The contents of the frame can then be read using Dynamic HTML and sent as a parameter hidden in a URL to any Web server in the Internet.

[4]demo page

Protective Measures

According to Ralf Hueskes of Jabadoo Communications, the security hole exploits an error in the Internet Explorer 4.0 that can be fixed only by the manufacturer. Microsoft is aware of the problem and will make available a patch for download from [5]http://www.microsoft.com/ie/ on October 17th 1997.

Experienced users can protect themselves by completely deactivating the execution of Active Scripting in the security settings (menu item: Tools/Options/Security, Settings/Custom (for expert users)/Active Scripting/Disable) and by using the Security Zones feature in Internet Explorer 4.0.

More Information

For more information (press only), please contact Ralf Hueskes of Jabadoo Communications (ralf.hueskes@jabadoo.de). Additional information can also be found in c't magazine, vol. 12/97 (to be published on 10/27/97).

Miscellaneous

Trademarks, program names, company names etc. mentioned on this Web page may be protected by trademark law and international agreements. Although all information has been verified, we cannot guarantee its correctness.

References

  1. http://www.jabadoo.de/index.html
  2. http://www.jabadoo.de/index.html
  3. http://www.heise.de/ct/
  4. http://www.jabadoo.de/press/ie4demo.html
  5. http://www.microsoft.com/ie/

27/09/97

`IN: Expresso, XXI`
As aventuras de um hacker português.

Excertos da vida de m0xx, o responsável do grupo Toxyn e talvez o «hacker» português mais famoso. São curtos episódios para reflectirmos todos, do cibernauta comum ao administrador de sistemas. Contados na primeira pessoa.

Ser «hacker» é a maneira como vivo. «Hackar» a vida. É a forma como encaro a sociedade. Um «hacker» é um bocado de tudo. Ser «hacker» é perceber como é que as coisas funcionam. Tens de perceber como funciona a máquina. O «hardware». O processador. O sistema. É como conhecer uma pessoa. Descobrir os seus pontos fracos. Um abutre dos pontos fracos dos sistemas de computadores, sim, mas que cumpre uma função, investiga a sua segurança. Há os que entram em máquinas e se divertem a destruir, claro.

Mas enquadro-me no grupo dos que passam dias de volta de uma máquina, de um programa, e quando descobrem um «bug», um erro, informam o meio através dos canais próprios, como alguns «newsgroups» da Internet. E, se for caso, avisa o responsável do sistema: «Descobri um 'bug' nesse sistema, usei este programa e está aqui a solução». É isso a filosofia «hacker».

Nunca «hackei» os computadores da Telepac. Tenho um colega que entrou neles há uns anos, quando ainda não estavam ligados à Internet. Depois, passeou pelo sistema da Direcção Geral das Contribuições e Impostos. Mas não fez nada: limitou-se a entrar. A Telepac é o «provider» português em que nunca entrei. Elogio muito a atitude deles face à segurança. São bons. Já aconteceu detectarmos falhas, irmos a correr testar aquilo e eles já tinham remendado o buraco. Atentos, viram ao mesmo tempo que nós e corrigiram. Agora, os outros, é mentira.

Mas todos os sistemas operativos são falíveis. Nenhum é cem por cento seguro. Há sempre uma falha algures. Há sempre um lado desprotegido. Há, sim, uns melhores que outros. Uns demoram mais tempo, outros abrem-se num instante. O Linux, por exemplo, é muito bonito mas tem grandes falhas de segurança. Também é verdade que são todas fáceis de resolver e estão documentadas. O problema é que os responsáveis nem sempre têm tempo para olhar para a documentação.

Qual é o mais inseguro? O NT tem-se revelado muito engraçado. Quem o usa não faz a menor ideia de que por detrás daquelas janelinhas tão bonitas existe um autêntico buraco de segurança. Foi feito para pessoas que não percebem patavina de redes nem de segurança... As janelinhas explicam tudo, «clique aqui para pôr no ar o servidor de Web», e ninguém imagina como aquilo é do outro lado das janelinhas: está absurdamente aberto. Dentro do universo Unix, o Irix tem grandes falhas, como o Linux. Mas o pior de todos é sem dúvida o NT. Um autêntico logro. Não é por custar muito dinheiro que um sistema é seguro. Os Macintosh são os mais seguros, por incrível que pareça. Havia um concurso de uma empresa sueca que oferecia milhares de dólares a quem entrasse pelo seu Web, e era totalmente seguríssimo. Sem «firewall», sem nada: directo. Ninguém no mundo conseguiu.

Existem vários grupos de «hackers» em Portugal. Conheço o meu grupo, o Toxyn, e os Pulhas. São dois grupos muito restritos e que se respeitam. Depois, há vários que gravitam à nossa volta, tentando sempre obter informações. Também os respeito. Podem até ser melhores, mas ainda não chegaram ao ponto de fazer alguma coisa com o que sabem. Obter resultados. Um «hacker» pode contribuir para muita coisa. Mas atenção, isto é recente. Depois da nossa acção da Indonésia surgiram dezenas de grupos constituídos por putos de 15 anos e que só daqui por uns anos serão bons. O que nós fizemos foi, sobretudo, despertar uma corrente adormecida. Incentivámos muita gente. Há muitos individualistas. Cá há bons «hackers». Talvez uns 20 competentes. Mas grupos respeitados, só Toxyn e Pulhas.

Encontramo-nos todos os dias virtualmente. Nos canais próprios de IRC ou de outras formas. E fazemos reuniões físicas, mas muito privadas. Somos muito organizados. Convoquei uma para a semana que vem. Estamos a elaborar um projecto. Queremos fazer uma campanha de segurança em Portugal. Tudo o que seja máquina portuguesa vai ser «hackada» e os resultados tornados públicos.

Sabes, o nosso grupo é o verdadeiro ídolo de muita malta nova. Recebemos centenas de «mails» de gente que sentiu orgulho em nós. Por sermos portugueses e capazes de fazer alguma coisa de jeito. Marcar presença numa causa. Porquê Timor? Porque somos portugueses. E há uma responsabilidade. Aquele povo longínquo que não tem nada a ver connosco, é completamente exótico, vai à missa, fala Português e têm orgulho em exibir a bandeira portuguesa.Tivemos um bocado de sorte nos resultados. Mas o acto de «hackar» foi lindo, tecnicamente difícil, lindo.

Agora temos projectos. E muita coisa para gerir: dezenas de miúdos que pedem para pertencer ao grupo; solicitações de grandes empresas, algumas internacionais, para fazermos a segurança dos seus «sites» e redes; há administradores de «sites» a mandarem-nos «mails» para que tentemos penetrar nos seus computadores e testar este ou aquele aspecto de segurança. E temos uma série de problemas com a nossa exposição. O grupo ficou um bocado exposto, o que é contra a nossa filosofia.

Benefícios? Sim. Eu arranjei um emprego por causa disto. Os meus patrões sabem bem quem sou e o que faço. E dentro do grupo alguns acabam por arranjar emprego. Mas enquanto organização não ganhámos um tostão. Podíamos ter pedido dinheiro pelas entrevistas na altura da Indonésia, em que fomos muito solicitados. Não quisemos ganhar dinheiro à custa da causa de Timor. Se fosse uma coisa só nossa, talvez o tivéssemos feito. Mas não somos uma empresa, somos um grupo.

Em Portugal já «hackei» de tudo, desde grandes empresas até universidades. Coimbra, por exemplo, Instituto Superior Técnico, Universidade do Minho, Aveiro... Só somos detectados quando cometemos algum erro. Mas nunca ninguém teve problemas, porque nunca realizámos os ataques através das nossas máquinas. Atacamos a partir de uma máquina nos EUA, ou na Suécia, e nunca nos rastreiam. Entre aspas, é tudo falso: nós controlamos tudo, e mesmo que cheguem a uma dessas máquinas não nos apanham, mesmo que estejamos lá. No caso da Indonésia, nunca apareceu uma referência sequer a máquinas portuguesas...

A minha formação sempre foi no ramo informático. Estou a acabar engenharia informática. Tive um Spectrum e logo aí já pirateava jogos. Publicava uma lista com quase quatro mil, alguns nunca editados em Portugal. Recebia-os, duplicava-os e distribuía mundialmente. Não fazia mais nada. Depois, veio o primeiro XT. Lá comecei com o DOS, que era uma porcaria autêntica, aprendi Pascal, vieram as BBS, tive o primeiro «modem». Sei programação. Basic, Pascal, Cobol, mas C e Perl é que contam actualmente.

Nunca entrei num banco. Mas já usei um Visa alheio. Que fiz? Comprei um domínio e mandei vir uns discos rígidos dos EUA. Para experimentar. Assim uns 600 contos de fraude. Mas o titular do cartão tinha contas à ordem de três mil contos... Portanto, não tive pena dele. E fi-lo apenas para experimentar. Não tenho interesse nisso, não sou ladrão. Fizemos coisas muito mais fraudulentas, como usar linhas da Telecom e da Marconi para o estrangeiro durante seis meses - as contas eram de largos milhares de contos. Não fomos apanhados, um outro grupo foi. Mas esses já estão bem empregados. Sabes, se alguém entrar numa grande empresa, os responsáveis preferem contactá-lo e tentar aliciá-lo. «Você entrou, tudo bem, quanto é que quer para trabalhar para nós?» É melhor do que passar a vergonha de admitir publicamente que os seus sistemas, supostamente tão fiáveis, foram invadidos por um puto de 14 anos. Foi assim que arranjei emprego.

Como se processa uma operação? Começamos por definir o alvo, o domínio. Um país inteiro, no caso da Indonésia. Primeiro obtemos os nomes de todas as máquinas debaixo desse domínio. Metemo-nos em cada máquina e analisamos os seus processos. É preferível então escolher uma máquina de Web. Analisamo-la porta por porta, para descobrir que programa corre e se já existem programinhas para neles entrar - se não, tentamos fazê-los nós. Se não conseguirmos entrar na máquina-alvo, tentamos as que lhe estão ligadas, ou seja, exploramos todos os pontos fracos em volta dela. Pode estar muito bem protegida de ataques frontais, mas uma outra que lhe dá acesso poderá não estar - e através da segunda entramos na primeira. Apanha-se então todo o tráfego dessa máquina - e é meio caminho andado. Saca-se a lista de «passwords», e pronto. Voltando ao exemplo, a máquina da Indonésia estava muito bem protegida. Tinha um único ponto fraco - foi o bastante. Acedemos à informação classificada, como a lista das embaixadas indonésias no mundo inteiro. Mas isso não interessava. Apenas alterámos o código da página de entrada - e, em vez da página oficial do Ministério dos Estrangeiros indonésio, via-se a nossa propaganda à causa de Timor.

O caso dos computadores militares foi mais engraçado, porque tinham um bom «firewall». Não passava nada, só porta 80. Mas o servidor tinha um «bug», era uma versão um bocado antiga, conseguimos abrir uma «shell» em Assembler para dentro da porta 80... Esta, supostamente, só dava saída a Web e nós entrámos por ela adentro. E o responsável ficou atónito porque não conseguiu descobrir «logs» (ficheiros de registo) em lado nenhum, nem sequer da porta 80. Não havia nada. Desligaram a máquina simplesmente. E segundo informações de lá (temos amigos «hackers» indonésios), o responsável passou um péssimo bocado antes de ser despedido. A pena para aquilo era fuzilamento. Se foi o caso temos pena, porque não queríamos prejudicar ninguém. Basicamente é isto.

Em Portugal há bons «hackers», mas «ciberchuis» ainda não. A Polícia Judiciária tem um domínio na Web mas ainda não anda aí atrás do pessoal. Preocupam-se com os que traficam «software» e nós não o fazemos. Já o SIS é diferente. Manobra pela calada. Não me espantaria nada saber que têm arquivos com dados sobre nós. Alguns de nós estaremos nos próximos anos a trabalhar para eles, não duvido... Mais vale contratar um gajo que saiba. Mas aí está: nós não somos criminosos. Somos um grupo restrito. Fazemos coisas possivelmente ilegais - possivelmente. Por isso é que somos muito reservados. Problemas em dizer isto publicamente? Como os Visas ou a Indonésia? Não. Não fiz nada ilegal. Há algum risco, mas aceito-o. A história do Visa é crime - sim, mas bancário. Não informático. Confesso porque fi-lo apenas para experimentar, não sigo esse caminho. E uma confissão pública em nome de m0xx não basta. Podia estar a dizer-te um chorrilho de mentiras. Podia estar aqui um gajo qualquer a dizer-te «pá, sou um grande 'hacker' e fiz isto» e ser mentira. Isto é muito confuso. <

Onde está o crime? Na pedofilia, rapto, aliciamento em «talkers», marcar encontro e abusar sexualmente. Ou piratear «software» e ganhar dinheiro com isso. Entrar num sistema não é crime. Entrar e alterar dados também não o é por si só: será quando as alterações prejudicarem terceiros. Admito que haja «hackers» profissionais, que trabalham pagos por serviços secretos ou países inimigos. Esses são criminosos, claro.

<END>

NOTA:

Esta entrevista, devido à demonstraçao de egocentrismo e narcisismo, gerou vários protestos na comunidade hacker portuguesa.

Quem ler só vai confirmar o que já se diz...que somos todos uns sacanas..e que não há amigos cá dentro..todos querem ser os maiores e só se consegue phodendo o próximo... k os grupos são 1 gajo que sabe e os outros pra fazer número..e por fim..que somos todos uns criminosos...que phodemos a vida a quem trabalha..sysadmin e bofias..

A cena do cartao de crédito e da marconi é a descrição tipica do que eles pensam ser um haxor.. alguem que caga no proximo ("o gajo tinha 3 mil contos..roubei lhe 600..e' merecido") e que não liga aos meios pra atingir os fins.. Ser o mais temido na comunidade
Bem..se é assim um haxor então acho que hoje muita gente chegou à conclusao que não são um.. e ficaram felizes por não o ser

26/09/97

`IN: News Flash Portugal`
S-MIME - Standard de e-mail seguro - Crackado
O standard de e-mail seguro S-MIME, que permite enviar e receber mensagens codificadas, foi recentemente crackado.
Bruce Schneier, um perito em criptografia, criou um programa para Windows 95 que permite descodificar mensagens codificadas usando o S-MIME, standard de e-mail seguro usado nos programas de e-mail do Netscape Communicator 4 e do Internet Explorer 4.
Este programa consegue descodificar uma mensagem em aproximadamente 35 dias num Pentium a 166mhz.
Para mais informações sobre este programa visite http://www.counterpane.com/

19/09/97

`IN: PC WEEK`
Hacker shocker: Research project reveals breaches galore
By Jonathan Littman, ZDNN

Hackers call it "war dialing."

A security expert has used this old hacker's technique to root out thousands of modem lines in Northern California that may be leaving corporations and individuals vulnerable to attack.

Peter Shipley of Berkeley, Calif., has been letting his computer do the dialing. A whole lot of dialing: 1.4 million numbers or so; 500 an hour, 12,000 a day. Roughly 14,000 of the 1.4 million numbers Shipley's program randomly dialed were modem lines, a figure that translates to thousands of open doors for would-be hackers to wreak havoc.

The huge research project has revealed case studies in bad security practices. Shipley's conclusion: Today, many companies and individuals are unaware of the risk that one unprotected modem line can pose to an entire computer network.

Shipley says that while many unaccounted-for modem lines are found in corporations, an increasing number of employees have direct dial-up access to corporate networks from home. And not surprisingly he notes, "a lot of the time they don't have good passwords."

Some startling findings of the telecommunications vulnerability study:

* An East Bay medical facility gives unrestricted modem access to patient records, making it easy for a hacker to steal, alter or delete private medical records;

* An Internet company offering financial services does not require a password to modify its modem-accessible firewall, potentially permitting intruders to install backdoors and disable auditing routines; and

* A Fortune 100 company's air conditioner and environmental control units can be easily changed by modem, enabling a hacker to overheat buildings or kill lights at will.

Shipley has not attempted to access any of the 14,000 sites his war-dialing method has found in Northern California, but his research raises questions whether basic security is widely practiced.

The security expert says he found numerous firewalls in Silicon Valley so poorly configured that intruders could easily gain total command of the firewall and the network behind it. Only three of every thousand modem lines he checked posted a warning banner, violating policy for many government sites and corporations.

"Some of them had a welcome banner on the screen, gave the name of the operating system, the release number, even in many cases the name of the corporation," said Ken Kumasawa a security consultant for TeleDesign Management Inc. in Burlingame, Calif., who reviewed the data. "This has been a no-no for about five or six years."

Instead of a welcome screen, Kumasawa says the modem line should have led to a warning screen -- or nothing. "To a certain extent it should be a blank screen," he said. "The person who is accessing it should know how to do it."

War dialing was popularized by the 1983 hacker-classic movie "War Games," which featured Matthew Broderick dialing his way to a direct connection with a military computer. In days past, hackers would mass-dial tens of thousands of phone numbers to find open systems from which to make further assaults.

But Shipley -- a security auditor who plans to publish a technical paper on his research -- says he's maintained a "look but don't touch" premise. He didn't attempt to access any of the systems his war dialer found, and for good reason. Unauthorized access carries criminal penalties.

Recent studies showing that 39 percent of homes have PCs may extend the risk of hacking. "As more and more home-access software appears, say to synchronize your laptop with your desktop, the risk of dial-up information warfare will increase," said Shipley. "Badly configured systems can permit hackers to gain access to a hard drive or printer, read or delete files, even run programs on your machine."

Jonathan Littman is the author of "The Fugitive Game" and "The Watchman."

19/09/97

`IN: News Flash Portugal`
Site da Coca-Cola hackado

O site da Coca-Cola foi recentemente alterado por hackers. Como consequência o web site foi fechado durante dois dias.

Um grupo de hackers alterou as páginas web da Coca-Cola, nelas inscrevendo a mensagem "vocês vão começar a olhar para o que bebem, olhar para o vossos Big Mac, e compreenderão que são ovelhas..."

A Coca-Cola confessou que foi a primeira vez que o seu web site foi alvo dos hackers.

Os responsáveis pelo acto ainda não foram identificados, mas o caso está a ser investigado.

13/09/97

`IN: News Flash Portugal`
"Revelation" revela passwords no Windows 95
Um novo utilitário chamado "Revelation" permite descodificar as passwords do Windows 95 guardadas no disco.
As passwords que os utilizadores usam para se ligarem à Internet ou à rede local ficam guardadas no disco, codificadas, quando o utilizador escolhe a opção "save password" para que não tenha que a re-escrever sempre que se liga à Internet.
Este novo utilitário permite lêr o ficheiro no disco onde as passwords se encontram, e descodificá-las.
No entanto é necessário ter acesso ao ficheiro que contém as passwords.
Para os utilizadores de Internet este novo programa não representa nenhuma ameaça, uma vez que não é possível que esse ficheiro de passwords seja obtido por estranhos quando navega na Internet.
Aos locais públicos que disponibilizam o acesso à Internet, aconselha-se que tomem medidas para que os utilizadores não possam ter acesso ao ficheiro de passwords que se encontra no disco rígido.
Este "revelation" foi criado pela empresa Snadbody (http://www.snadboy.com) e está disponível gratuitamente.

04/09/97

À 1:20 da manhã o server www.bapedal.go.id/ foi hackado pelo _Phantom_:

Antes

Depois
02/09/97

New Mexico State Library, hacked by MaxOut
ZenScope Online, hacked by OptikLenz of Legions of the Underground

02/09/97

Altavista Technology, Inc. hacked by Intruder

01/09/97

`IN: Público, Suplemento Computadores`
Telepac e ASSOFT discutem pirataria na Internet

Num "newsgroup" gerido pela Telepac forma disponibilizados cópias ilegais de "software", como o corrector ortográfico "Flip97", da Priberam. A Associação Portuguesa de Software (ASSOFT) exigiu à Telepac que actuasse no sentido de responsabilizar criminalmente os autores desta vioalção dos direitos de autor. A Telepac estuda a questão, mas está relutante em reconehcer que deve controlar os coneúdos disponibilizados através da Internet e alerta para o caractér polémico desta questão.
Respondendo aos pedidos da ASSOFT, a Telepac colocou, na semana passada, uma mensagem neste "newsgroup" - telepac.binarios - em que adverte contra a ilegalidade em que estão a incorrer os seus utilizadores ao partilharem "software" não autorizado.
Mas quanto à exigência de apagar os ficheiros ilegais a Telepac não a satisfez. "Só poderemos agir se tivermos ordem para isso do tribunal. A partir do momento que façamos isso, como fornecedores de serviços, estamos a assumir responsabilidade pelo controlo de todos os conteúdos da Internet, que é humanamente incontrolável", disse ao PÚBLICO Arlindo Costa, director de "marketing" da Telepac.
...

30/08/97

`IN: Urban Ka0s Homepage (http://www.urbanka0s.org)`
Our sysadm has received threats the local secret service advising him to close down urbanka0s.org. We believe indonesia is behind this, and is pressuring the local goverment close us down. Of course, these actions will receive retribution.

28/08/97

`IN: CuD, Wed Aug 28, 1997`
From: Jim Thomas <jthomas@well.com>
Subject: File 4--AOL Target of Credit Card Scam

The Chicago Tribune (27 Aug '97, p. 3) reported a scam that attempted to target AOL subscribers two weeks ago. The story describes how e-mail, disguised as official correspondence from AOL attempted to entice subscribers to divulge credit card numbers and other sensitive information. The scam worked by inviting subscribers to click on a link that took them to an official looking homepage, where a letter, ostensibly by AOL's CEO Steve Case described AOL's successes in fixing bugs. Subscribers where then asked to update their AOL accounts by supplying confidential information.

When AOL users log on to AOL, a prominent note reminds them that AOL personnel will *never* ask for such information. It's not known how many users were victimized by the scam, and the fraudulent homepage was apperently up only for a few hours.

Unlike sex-related crimes, there have been no screaming "INTERNET BLAMED IN SCAM ATTEMPT" headlines. That's encouraging. It's hardly a surprise that the Net contains predators, just as do churches, highschools, and police departments. The trick, which the media seem to be slowly catching on to, is not to create hysteria with clueless horror stories, but to stress a few basics. In this case, one of the cardinal rules pertains: Do not give out personal information to strangers on the Net. In this case, however, the scam was sufficiently clever that it could easily catch inexperienced (or even some experienced) netfolk. A second rule then pertains: Double check the sources - if something seems odd, avoid it.

The text of "spam" letter setting up the scam was posted on The Well (a public access community in California's Bay Area--http://www.well.com for info) on August 12 by <amicus@well.com>.

============

Tue 12 Aug 97 04:51

I just got what is apparent Spam that would seem to go far beyond illegal... it purports to be from AOL (address is something like "ServerUpdate@aol.com") and contains a letter from Steve Case, along with a URL on an IP-address-only site. When you go to the site, you're in a secure form, purporting to be a reregistration form for you with AOL, asking for various confidential information. The page bears logos for both RSA and VeriSign... it seems to be crafted to *look* legit, for those folks who merely understand that the Internet *can* be secured, somehow. Checking headers, the thing seems to have come from UUNet (surprise!). For those who want to check it out, the URL is http://209.41.43.223/index.htm

-------------

here's what I got... NB the bogus domain (aoI.com) and the "Authenticated server is..." comment. Clever enough to catch newbies, certainly.

<begin letter>

From AOL-ServerUpdate@aol.com Tue Aug 12 08:22:50 1997
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16])
by embassy.org (8.8.4/8.8.4) with ESMTP
id FAA18670 for ; Tue, 12 Aug 1997 05:24:13 -0400 (EDT)
From: AOL-ServerUpdate@aol.com
Received: from mail.uu.net by relay6.UU.NET with SMTP
(peer crosschecked as: slip129-37-52-122.ca.us.ibm.net [129.37.52.122]) id QQdcgj02863; Tue, 12 Aug 1997 05:24:11 -0400 (EDT)
Received: from mail.aoI.com (alt.aoI.com (207.34.342.246)) by aoI.com (8.8.5/8.6.5) with SMTP id GAA01943 for <ServerUpg@aol.com>; Tue, 12 Aug 1997 05:18:19 -0600 (EST)
To: ServerUpg@aol.com
Message-ID: <173840394782.GAA73847@aoI.com>
Date: Tue, 12 Aug 97 05:18:19 EST
Subject - Important AOL Information! Please Read. --)
Reply-To: AOL-ServerUpdate@aol.com
X-PMFLAGS: 34078848 0
X-UIDL: 268493654736a37aeb4b67463529878e
Comments: Authenticated sender is <AOL-ServerUpdate@aol.com>

Special News Bulletin:

August 12, 1997

Dear Members:

As you know, the number one priority for all of us at America Online continues to be meeting our obligation to provide you with the best possible service. We have been working day and night to fix the busy signal problem and to catch up with the incredible surge in demand for AOL. In this month's letter, I'd like to give you an update on how we are doing.

When it became clear to us that unlimited use pricing stimulated more demand for AOL than we had anticipated, we announced a $350 million expansion program and made four commitments to you:

  - To expand system capacity as quickly as possible
  - To serve our existing members before adding new members
  - To work extremely hard to maintain the loyalty of members who've had problems with busy signals
  - To communicate frequently about the steps we are taking to improve AOL

  So let me update you on what we're doing to meet each of those commitments, including the development of a new server which offers a higher system capacity.

  You may either take a moment to read in depth about the steps we have taken, or just complete the required update of your information on our new servers.

  Please Click <A HREF="http://209.41.43.223/index.htm">HERE</A> to Continue.

  All you have to do is click on the text above with your left mouse button and it will take you directly to our new information screen.

  Thank you for your Cooperation,
  AOL Member Services

  Below are the Headers used by AOL's newly developed servers.
  Please Disregard these they are of no importance.
  <end letter>

25/08/97

Mudamos de server, outra vez! Agora estamos em http://www.complex-x.net/kaotik/
Esperem grandes novidades!! Guestbook, NewsBoard e um Hack Search Engine serão apenas algumas das novidades!
Um agradecimento ao ppl da Complex-x por nos terem oferecido o WebSpace. Thanks ppl :)

25/08/97

`IN: CuD, Mon Aug 25, 1997`
From: "noah@enabled.com" <noah@enabled.com>
3--When you do this, don't forget your friends! (fwd)

Source -noah

Hackers' Paradise: Get Wealthy Legally By Cracking a Code --- Crypto-Logic Offers to Pay $1 Million to the Breaker

The Wall Street Journal via Dow Jones

A start-up company would like you to hack your way to $1 million. Crypto-Logic Corp. of Austin, Texas, claims to have created an encryption system for electronic mail so foolproof that it can't be broken. If someone can figure out a special encrypted e-mail message within a year, the company says it will pay a reward of $1 million.

But wait. The technology Crypto-Logic is using for the contest hasn't exactly been foolproof. The three computers needed to create the contest's Web site unexpectedly scrambled data in the site last week, said David Neeley, vice president and chief operating officer.

The breakdown forced him to backtrack from last week's announcement that the contest would begin last Friday. Instead, he spent several days attempting to fix the computers, but to no avail. On Monday, he had to get replacement computers. "I've got thousands of dollars worth of machinery that's not worth blowing up," he grouses. But he adds, "I regard this as my screw-up. In this world, there are no excuses." He finally got the contest running Wednesday, at www.ultimateprivacy.com.

On the bright side, cryptologists agree that the decades-old encryption method that Crypto-Logic is claiming to use -- called a "one-time pad" -- is theoretically unbreakable. Each "pad" has a set of uniquely random digital symbols that are coded to the actual message. The recipient uses the same symbols to decrypt the message. The pads are used only once. To limit the possibility of leaks, Crypto-Logic Chairman Stan Spence is the only person who knows the message that was encrypted. The solution is kept in a NationsBank vault in Austin, Mr. Spence says. In addition, Mr. Neeley says the $1 million is backed by an insurance company he won't name. Several other companies have held similar contests, typically offering more modest sums.

Jim Bidzos, president of RSA Data Security Inc. in Redwood City, Calif., says his company frequently holds break-the-code contests to test how tough certain encryption systems are. But he and other security experts are skeptical of Crypto-Logic's assertions. "Anyone who says their system is bulletproof is either a liar or stupid," says Winn Schwartau, a Largo, Fla., security expert. Mr. Neeley admits his integrity is on the line. "If I'm wrong," he notes, "we're out of business."

WSJviaNewsEDGE

25/08/97

`IN: CuD - Mon, 25 Aug 1997 21:04:52 -0500`
From: Jon Lebkowsky <jonl@onr.com>
6--Cyber Rights '97

Cyber Rights '97 September 21, 1997 1pm - 6pm Joe C. Thompson Conference Center 26th and Red River, Austin, Texas Admission is Free

Featured speakers:

Ann Beeson, attorney for the ACLU and part of the legal team for ACLU vs. Reno

Ed Cavazos, Sr. VP, General Counsel of Interliant, Inc. and co-author of Cyberspace and the Law

Gene Crick, president of the Metropolitan Austin Interactive Network and Editor of the Texas Telecommunications Journal

Mike Godwin, counsel for the Electronic Frontier Foundation

Pete Kennedy, attorney with George, Donaldson, and Ford

David Smith, vice-president of EFF-Austin and member of the Central Texas Civil Liberties Union Board of Directors

Dr. Sharon Strover, director of the Texas Telecommunications Policy Institute

Moderated by Rich MacKinnon, with an Introduction by Jon Lebkowsky

On the plate:

How Internet rating and filtering systems can stifle free speech on the Net

Why public libraries can't use filters, including a discussion of the use of CyberPatrol by the Austin Public Library

The future of state regulation of the Internet, including Texas HB1300, which requires ISPs to link information about filtering software to their home pages

_ACLU v. Reno_ (Supreme Court overturns Communications Decency Act)

Intellectual and Copyright issues in the civil liberties/freedom of expression framework, including the increasing capitalization of ideas, and the erosion of "fair use"

Children and the Internet

Telecommunications infrastructure and the state's role in regulating telecommunications systems computers and networks in schools

Spam -- the need for, and dangers of, regulating commercial speech on the internet regulating commercial speech on the internet

Encryption and communications privacy

Sponsored by
The Texas Telecommunications Policy Institute
George, Donaldson, and Ford
EFF-Austin
ACLU of Texas
--
Jon Lebkowsky http://www.well.com/~jonl
jonl@onr.com cdb, wfm, vb et al

24/08/97

Self Induced Negativity [SIN] (http://www.sinnerz.com/) hacked!
  Antes do ataque
  Depois do ataque

22/08/97

`IN: BUGTRAQ - Mon, 25 Aug 1997`
From: Peter Shipley <shipley@DIS.ORG>
Subject: Active X exploit.

There is a new expliot for active X

http://www.network-security.com/activex/

http://www.dis.org/maglite/

This is a very interesting hole since this is the first time that someone actually published the source code for examination. The code was stolen by maglite from a recent 2600 meeting from the author, a dude named Toby . But the attack is very interesting in the sense that allows you to turn off the security restrictins of Internut Explainer 3.2 using activeX just by connecting to a WWW page.

Check it out. It is bundled with the getadmin stuph published by the Russian named Sokolov (?)

-Pete

22/08/97

`IN: BUGTRAQ - Fri, 22 Aug 1997`
From: "Andre L. Dos Santos" <andre@CS.UCSB.EDU> Subject: Netscape Communicator 4.01a and 4.02 for Windows 95/NT allows disclosure of your passwords

Using the latest Netscape Communicator we are able to get your credit card number, password for online banking or online brokerage order, etc, only restricted by the imagination of the malicious server implementer. This is due to a flaw in Javascript identified by the Reliable Software Group at University of California Santa Barbara. It enables a malicious site to track all activities of a user in the Internet. Besides being able to get this information, which violates the user's privacy, by using an ingenious technique we are able to target chosen pages and use a fake server to convince the user to type in privileged information. We submitted a security bug report to Netscape, but we believe that this is a very serious threat, which is easy to implement. As such it should be widely disseminated. This flaw was tested in Netscape Communicator 4.01a, the latest version of Netscape, and it is described, together with other attacks in our paper at http://www.cs.ucsb.edu/~andre/attacks.ps.

Netscape has released a new version of Communicator for Windows 95/NT. It is Netscape Communicator 4.02. In this version our attack is much more threatening. This is because on the previous version the access on the location object was better implemented and in order to get a string value to this object we had to close a second browser we opened. Using the new version of Netscape we are able, using an infinite loop, to access the string that represents the location object, against the security policy of Javascript. Therefore, using this version, we don't even need to close the second browser. We are still investigating which other security policies are badly implemented in this new version of Netscape Communicator.

Andre L. dos Santos
Reliable Software Group
University of California Santa Barbara

15/08/97

`IN: News Flash, 15 de Agosto de 1997`

"Atalho" encontrado nas leis de encriptação
Foi recentemente encontrado um "atalho" legal, que permitiu exportar a versão americana do popular programa de encriptação (codificação de dados) PGP, sem quebrar nenhuma lei americana sobre esta matéria.
As leis americanas sobre a exportação de software de encriptação limita a exportação a software bastante fraco, deixando o popular e fortíssimo PGP sem qualquer hipótese.
Mas recentemente este mesmo PGP foi colocado no web site de uma universidade de Oslo sem quebrar qualquer lei.
Este "feito" foi conseguido ao imprimir todo o "código fonte" do PGP, transformá-lo num livro, exportá-lo para a Europa, e transformado de novo em software com a ajuda de um "scanner" e software de reconhecimento de caracteres.
Um porta voz da companhia responsável pelo PGP disse "nós acreditamos que as portas devem ser abertas à exportação de software de encriptação" acrescentando que "não estivémos de modo nenhum relacionados com esta 'brincadeira' ".

15/08/97

`IN: News Flash, 15 de Agosto de 1997`

Mais um bug no Internet Explorer

A Microsoft está a investigar mais um bug descoberto na implementação do Java no Internet Explorer versões 3 e 4.

Hoje em dia parece que os bugs nos browsers (programas para ver páginas web) não param der ser descobertos.
Este novo bug, descoberto por um programador do Colorado, e que afecta as versões 3 e 4 do Microsoft Internet Explorer, permite que algumas "applets" java possam enviar e receber imagens de e para o computador do utilizador.

Mas o potencial "hacker" que queira tirar partido deste bug precisa de saber o nome e localização exacta da(s) imagem(s) que pretende obter e/ou alterar do computador do utilizador.

No entanto o bug pode tornar-se sério no caso de trabalhadores de empresas que queiram causar algum dano à rede da empresa, uma vez que esses trabalhadores poderiam saber as localizações exactas dos ficheiros de imagem que pretendia obter e/ou alterar.

A Microsoft está a estudar o bug atentamente e irá publicar mais informação em http://www.microsoft.com/security

14/08/97

Date: Thu, 14 Aug 1997 14:34:40 +0100
To: kaotik@mail.org
From: Yyyyyyy <yyyyy@mail.terravista.pt&
Subject: A sua pagina no Terravista - Meco 1199

Caro marujo,

Depois da alegre troca de correspondencia com o meu colega Xxxxxxxx Xxxxxx pensamos que retiraria a sua pagina de livre iniciativa.

Como e evidente nao podemos albergar uma pagina que retrata nao so o Terravista como os seus apoiantes de forma abusiva e caluniante, ja para nao falar da linguagem utilizada.

Agradecemos que nao volte a colocar conteudos deste tipo no Terravista.

Atentamente

11/08/97

`IN: Netly News, 11 de Agosto de 1997`

by Noah Robischon August 11, 1997
Nothing makes hackers happier than breaking into a computer that another hacker set up, especially when an appreciative audience is watching. Small surprise, then, that there were plenty of grins at last weekend's Beyond HOPE hacker convention in New York City.

The first break-in attempt came at about 4 a.m. on Friday when a huge, tattoo-encrusted Englishman named Cyberjunkie ran a utility that probed the network of HOPE's Dutch sister conference, Hacking In Progress. The plan: to expose any weaknesses, then peel away the security measures of the target computer like the layers of an onion. The program quickly found several obvious security holes. "So I had to do something," Cyberjunkie says. "It's a bit like waving a red flag at a bull, isn't it?" Like the encierro at Pamplona, Cyberjunkie sent a stampede of null information into one of the server's memory buffers until it choked and overloaded. Quietly attached at the end was a simple script that granted him the access he wanted. (In hacker argot, this is known as an IMAP exploit.)

Because hacking is not only encouraged but rewarded at HOPE -- which conference organizer Emmanuel Goldstein revived this summer after a three-year hiatus -- each of the thousands of participants received an IP address with which they could glom onto the Puck Building's 10-megabit network and connect to the rest of the world. The Pittsburgh-based DataHaven Project provided 15 public terminals, but Ethernet hub plugins were plentiful. Confused? No problem. The 13-year-old with braces in the next chair was glad to help out. After all, he'd already hooked his ancient DEC, Hewlett-Packard or portable IBM onto the Net and was busily trying to gain root access.

When you'd tired of chatting on IRC #hope (topic at 4:11 p.m. on Saturday: "HOPE is a commercial enterprise full of bullshit"), you could browse through the various kinds of phone equipment, T-shirts or software that were on sale. Ether Bunny sold $250 worth of lineman's equipment (including several Southwestern Bell hard hats) in just over an hour. There was, of course, a constant stream of panels to attend: Tiger Teaming (better known as security consulting); cryptography; how to hack Windows NT; Metrocard hacking; a prisoner panel that included Bernie S. and Phiber Optik; and an amazing talk on privacy given by investigator Steve Rambam.

Best known for tracking down 161 Nazi war criminals hiding in Canada, Rambam is a consummate connoisseur of databases. "It is true that I can go online and reliably determine if you are a homosexual or a lesbian. It is true that I can go online and determine your religion. I can go online and, without breaking a sweat or getting carpal tunnel syndrome, find what movies you rent at Blockbuster," he said.

Yet Rambam takes an unlikely stance on the privacy issue, especially in a room full of paranoids. Closing off databases, he says, will not adversely affect his work -- since he'll always be able to buy the information from someplace. "It will harm the ability of the average person to control their lives; to check up on government to see if they are lying to him, to check up on big business to see if they are lying to him, to check up on the guy next door and see if he is an ax murderer," he said.

Now Rambam may be biased, for he operates a billion-record database that is accessible online to subscribers (he refused to give the URL for fear of hacking attacks). Nevertheless, it was rare to see so many teenagers taking copious notes, noted fellow attendee Shabbir Safdar. The audience couldn't get enough of Rambam, who looked more like a fed than a hacker in his custom-made Hong Kong suit. (A big hit was when he detailed how to turn a dead man's identity into your own.) But ultimately, Rambam questioned why anyone would want to: "The fact of the matter is that there is no real reason to hide most of who you are and what you do."

It's an unfortunate but true statement about the state of hacking today. Where have all the good hacks gone? Three years later and the flimsy Metrocard is still impenetrable. A panel of hackers turned security consultants showed that one of the biggest challenges for today's data cowboys was changing the preconceived notions of hackers held by the corporations they work for.

Keynote speaker Brock Meeks, went so far as to admonish the crowd for their low hacker batting average (only 20 percent of all government computer systems have been hacked). His address was putatively a history of hacking in America, but it sounded more like a call to arms for the audience. "You're going to have to learn how to hack the media, because you haven't been doing a good job of it," Meeks said.

Indeed, hackers get their share of bad press, and they gripe about it to no end. And HOPE highlighted the split personality hackers bring to their relationship with the media. Like most groups, they lambaste journalists. Yet their keynote speaker wasn't an agent provocateur, but a member of the press (albeit an esteemed one who champions the hacker cause). There was a panel discussion (which I participated in) where hackers could finally turn the tables on the media in attendance. "No weapons allowed," said the schedule of events. Yet only one of the audience's questions criticized the press, specifically noting John Markoff and his book on Kevin Mitnick. There was even a "Media Portrayal of Hackers" survey being distributed by a University of Tennessee sociology student as part of his master's thesis.

Perhaps it's useless to analyze hacker-vs.-media steretypes. After all, the hacker community has shown that it can successfully run its own magazines, pirate radio stations and web sites. If it's true that information technology is going to obliterate old media, the horsemen of the apocalypse are more likely riding from alt.2600 than from Wired. "The whole 2600 thing is a media hack," admitted Goldstein. And the success of this year's HOPE showed not only that Goldstein knows how to co-opt the media but that he might be a damn good entrepreneur as well.

09/08/97

Depois de nos terem censurado mais uma página na Terràvista decidimos construir uma página de protesto. Encontra-se em http://www.terravista.pt/meco/1199/ (que já foi censurada, por isso já não lá está) e em http://secretos.home.ml.org/censuravista/

08/08/97

Date: Fri, 08 Aug 1997 11:03:24 +0100
From: XXXXX XXXX <xxxxxxx@mail.terravista.pt>
Subject: A sua pagina no Terravista

Caro marujo,

A sua pagina em http://www.terravista.pt/mussulo/1141/ptzine00.txt encontra-se em clara violacao das regras que aceitou ao imigrar para o Terravista.

Lamentavelmente e por esse motivo, somos forcados a anular o seu registo.

Sera' sempre bem vindo, desde que respeite as regras de alojamento neste site.

Obrigado

08/08/97

Crime and Crypto: A Report Shaded Gray
by Wired News Staff
5:02am 7.Aug.97.PDT

The reports sound ominous:

In Italy, the Mafia is downloading PGP to help ward off investigators.

In Colombia, the Cali cocaine cartel maintains encrypted personnel files - complete with lists of relatives to be leaned on when necessary - and has scrambled some of its telecommunications.

In Japan, the Aum Shinri Kyo cult kept RSA-encrypted plans for launching a chemical and nuclear campaign of mass murder both at home and in the United States.

A study by two authorities on the US encryption debate lists many more incidents in which cops have faced down criminals armed with the cryptographic means to hide what they're doing. But amid the discussion of all that these developments imply, the doom scenario one might be tempted to cut to in a report by government-friendly crypto experts is remarkably missing.

Instead, the authors - Georgetown University computer scientist Dorothy Denning and William Baugh, vice president of Science Applications International Corp. and former assistant director of the FBI - conclude that strict export controls and key-management systems are unlikely to stop criminals.

"No approach to encryption will be foolproof. Whereas export controls clearly have an impact on product lines, they do not keep unbreakable encryption out of the hands of criminals entirely," says the report, which Denning and Baugh developed over the past six months and began circulating late this spring. It was published last week.

The report is part of a series by the National Strategy Information Center's US Working Group on Organized Crime, a group that includes academics, congressional staffers, and officials from the Defense Department, FBI, Drug Enforcement Administration, and Federal Reserve.

Sifting through accounts of criminal cases involving encryption - some from law officers or security professionals, some from academic or government studies, some from journalists' accounts - Denning and Baugh estimate the total number of criminal cases involving encryption worldwide is at least 500, with an annual growth rate of 50 percent to 100 percent. But the report's collected anecdotes suggest that so far, though, encrypted files have sometimes slowed investigations and made them more expensive, and that law officers have found ways to crack ciphers or used other evidence to complete prosecutions.

Denning, known in the past as a backer of strict controls on encryption and of systems such as the Clipper chip to afford government access to data, said she's given pause by the report's finding that prosecutors have not been derailed by encrypted evidence.

"It's put me in a greater state of doubt than at the beginning," she said in an interview last week. But the report noted that currently, criminals often use off-the-shelf technology and other methods that are often easily cracked, as in the case of former CIA agent Aldrich Ames, who was convicted of espionage in part because of a easily breakable commercial program he used to encrypt data.

"Not everyone wants to spend their time messing around with technology; then there are others who are willing to do it," Denning said. "It will go in both directions."

The report also says that although the spread of strong cryptography "could become a serious threat to law enforcement and national security," police and prosecutors face plenty of challenges from technologies that help criminals hide data (such as compression and steganography) and spy on adversaries.

"One thing that was discussed when the paper was presented to the group is that you can forget about encryption - there are more basic problems law enforcement has to deal with," like staffing and basic technologies, says Jeff Berman, executive director of the National Strategy Information Center.

For instance, some big drug dealers were not encrypting phone calls, but instead swapped phones to stay ahead of the police. In one Keystone Kops-type episode, the DEA noticed a large number of calls to Columbia on their phone bill, and realized that the Cali cartel had cloned the DEA's own number.

The report concludes that export controls have had a double-edged negative effect: It has prevented businesses and law enforcement outside the United States from getting strong encryption, but has not stopped determined criminals from obtaining it.

Conversely, the report says, "One effect of lifting export controls is likely to be increased availability and use of encryption to protect sensitive information from organized crime." Although criminals would also have greater access to crypto programs, the report argues, market demand for key recovery systems could lead to a situation in which police will be able to retrieve keys to crime-related data.

The report cuts across lines of the current legislative-executive debate on encryption and how it should be regulated. Since last year, both houses of Congress have worked on bills that would reverse the Clinton administration's export controls and ban mandatory key recovery systems.

In the House, Virginia Republican Bob Goodlatte's Security and Freedom through Encryption Act has gained a majority of members as co-sponsors. However, a parallel bill in the Senate has been shouldered aside by John McCain and Bob Kerrey's Public Network Security Act, which offers industry incentives for participating in a key recovery system and preserves the current export controls on the technology. The current handicapping of the battle of the bills - despite an August-long lobbying campaign by civil liberties and Internet users groups - is that any final legislation will significantly weaken the House provisions.

The study also faults key recovery systems on several points, perhaps most importantly the fact that they themselves could be abused either by criminals or government officials. Another widely publicized study of large-scale key-management infrastructures, put out in May by a team of cryptographers and computer scientists opposed to controls, concluded that such systems would be so expensive and technically complex that they are simply impractical.

So if strict export controls don't work and key recovery systems open up a whole new Pandora's box of criminal activities, what's the best encryption policy?

"It's a hard, hard, hard question," Denning said. "To me, a lot of it boils down to whether trying to regulate it is a good idea, and I'm not convinced either way."

01/08/97

`IN: BUGTRAQ, Fri, 1 Aug 1997`

From: Aleph One aleph1@DFW.NET
Subject: Netscape Communicator Bug
To: BUGTRAQ@NETSPACE.ORG

http://www.iti.gov.sg/iti_people/iti_staff/kcchiang/bug/

Netscape Communicator Bug demonstration

This bug affects netscape communicator (even version 4.01a) with Java and Javascript enabled. I've tested it on Windows 95/NT and Linux.

This bug lets a mailicious site achieve the same effects as the recently reported JavaScript bug. However, the mechanism to achieve the effect is different. Unlike the reported JavaScript bug, this exploit doesn't spawned off a separate window, and is thus more "invisible" to the user.

After leaving this page, any web site that you subsequently visit will be captured by this web server. The information you enter into forms will be captured too, but this will sometimes not work (I've no idea why). To view the information captured on you, simply visit http://www.iti.gov.sg/cgi-bin/track.cgi when you're done going to other sites.

You may want to turn off Java/JavaScript until Netscape resolved this bug.

Update
Netscape has confirmed the bug, and has a fix for it. I don't know when the new release will be available (check out their web site).
ZDnet has a report on this bug. You may want to check out their site: http://www5.zdnet.com/zdnn/content/zdnn/0725/zdnn0005.html

Kuo Chiang (kcchiang@iti.gov.sg)
Assoc Member of Technical Staff,
Information Technology Institute (Singapore).

17/07/97

`IN: NTsecurity mailing list`

From: Aleph One
Subject: Another hole poked in Communicator
To: BUGTRAQ@NETSPACE.ORG
http://www.news.com/News/Item/0.4.12840,00.html?latest

Another hole poked in Communicator By Alex Lash July 25, 1997, 7:10 p.m. PT

Netscape Communications (NSCP) today confirmed that another hole has been punched in its Communicator browser, the fourth one since the product shipped in June.

Discovered by Kuo Chiang of the Singapore's Information Technology Institute, the security flaw affects both Macintosh and Windows versions of Communicator. It produces identical results to two previous flaws related to JavaScript, a scripting language Netscape invented and uses in its browsers. It allows a Web site administrator to place a nearly-invisible applet on a user's hard drive then track the user's progress across the Web, including any data the surfer types into the browser such as credit card numbers.

The company knew about the bug yesterday and has already fixed it, according to senior security product manager David Andrews. A new version of Communicator will be available in two weeks to coincide with a scheduled software upgrade. Users will have to download the entire suite to patch the security flaw.

Despite having identical results to two previous JavaScript holes, the latest bug is due to the company's use of LiveConnect, a separate language used to connect Java and JavaScript, Andrews said.

"LiveConnect is the way Java and JavaScript communicate with each other. It's exposing information that it shouldn't be."

Not nearly as scrutinized as Java and ActiveX, JavaScript and other scripting languages are nonetheless used extensively to deliver information to browsers. Andrews insisted that the architecture of JavaScript and LiveConnect are not problematic, but their implementation in the browser software has created security breaches.

Microsoft's browsers were also affected by the previous JavaScript bugs. The company released a patch for Internet Explorer 3.0 earlier this week. It is unclear if the latest bug affects Explorer as well. Another hole poked in Communicator By Alex Lash July 25, 1997, 7:10 p.m. PT

Netscape Communications (NSCP) today confirmed that another hole has been punched in its Communicator browser, the fourth one since the product shipped in June.

Discovered by Kuo Chiang of the Singapore's Information Technology Institute, the security flaw affects both Macintosh and Windows versions of Communicator. It produces identical results to two previous flaws related to JavaScript, a scripting language Netscape invented and uses in its browsers. It allows a Web site administrator to place a nearly-invisible applet on a user's hard drive then track the user's progress across the Web, including any data the surfer types into the browser such as credit card numbers.

The company knew about the bug yesterday and has already fixed it, according to senior security product manager David Andrews. A new version of Communicator will be available in two weeks to coincide with a scheduled software upgrade. Users will have to download the entire suite to patch the security flaw.

Despite having identical results to two previous JavaScript holes, the latest bug is due to the company's use of LiveConnect, a separate language used to connect Java and JavaScript, Andrews said.

"LiveConnect is the way Java and JavaScript communicate with each other. It's exposing information that it shouldn't be."

Not nearly as scrutinized as Java and ActiveX, JavaScript and other scripting languages are nonetheless used extensively to deliver information to browsers. Andrews insisted that the architecture of JavaScript and LiveConnect are not problematic, but their implementation in the browser software has created security breaches.

Microsoft's browsers were also affected by the previous JavaScript bugs. The company released a patch for Internet Explorer 3.0 earlier this week. It is unclear if the latest bug affects Explorer as well. Another hole poked in Communicator By Alex Lash July 25, 1997, 7:10 p.m. PT

Netscape Communications (NSCP) today confirmed that another hole has been punched in its Communicator browser, the fourth one since the product shipped in June.

Discovered by Kuo Chiang of the Singapore's Information Technology Institute, the security flaw affects both Macintosh and Windows versions of Communicator. It produces identical results to two previous flaws related to JavaScript, a scripting language Netscape invented and uses in its browsers. It allows a Web site administrator to place a nearly-invisible applet on a user's hard drive then track the user's progress across the Web, including any data the surfer types into the browser such as credit card numbers.

The company knew about the bug yesterday and has already fixed it, according to senior security product manager David Andrews. A new version of Communicator will be available in two weeks to coincide with a scheduled software upgrade. Users will have to download the entire suite to patch the security flaw.

Despite having identical results to two previous JavaScript holes, the latest bug is due to the company's use of LiveConnect, a separate language used to connect Java and JavaScript, Andrews said.

"LiveConnect is the way Java and JavaScript communicate with each other. It's exposing information that it shouldn't be."

Not nearly as scrutinized as Java and ActiveX, JavaScript and other scripting languages are nonetheless used extensively to deliver information to browsers. Andrews insisted that the architecture of JavaScript and LiveConnect are not problematic, but their implementation in the browser software has created security breaches.

Microsoft's browsers were also affected by the previous JavaScript bugs. The company released a patch for Internet Explorer 3.0 earlier this week. It is unclear if the latest bug affects Explorer as well.

17/07/97

O server neuro.pidt.bppt.go.id foi hackado pela UrBaN Ka0s Org.

14/07/97

`IN: NTsecurity mailing list`

From: Weld Pond weld@l0pht.com
To: ntsecurity@iss.net
Subject: [NTSEC] Announce - L0phtCrack 1.5 available

L0phtCrack 1.5
Released 7/12/97

Available at http://www.l0pht.com/advisories.html

mudge@l0pht.com
weld@l0pht.com

OVERVIEW

L0phtCrack 1.5 is a tool for turning Microsoft LANMAN and NT password hashes back into the original clear text passwords. The program does this using dictionary cracking and also brute force. L0phtCrack 1.5 returns not just the LANMAN passord but the NT password up to 14 characters in length.
Version 1.0 of L0phtCrack was deficient because the graphical version of the program did not support the brute force method. This has been fixed for version 1.5. The brute force efficiency has been improved and an option to select the character set that makes up the password has been added.
The default behavior of L0phtCrack is to do a dictionary attack on the password file and then brute force the remaining uncracked passwords. Sample password files are named pwfile.txt, pwfile2.txt, pwfile3.txt and pwfile4.txt. A 28000 word dictionary file is included named wfile.txt. You can dump passwords directly from L0phtCrack if you have administrator rights.
L0phtCrack 1.5 includes the ability to dictionary attack or brute force the network NT server challenge that is used to prevent the OWF from going across the wire in its plaintext format. Sample network sniffed challenges are in files sniff.txt and sniff2.txt. This means you can get NT passwords without administrator privileges if you have network access between the client and the server.
You can build the sniff files by hand using your favorite network analyzer or wait for our tool which sniffs the network and builds these files. The sniffing tool will be made available shortly.
Also to be made available shortly is a commercial multiprocessor version, L0phtCrack/SMP 1.5 for NT and Solaris. Contact l0phtcrack@l0pht.com for more information.
...............

14/07/97

`IN: Público - Secção Computadores`

Piratas "roubam" tempo de acesso à Internet
O nome da Telepac foi usado por um grupo de utilizadores dos "newsgroups", que em nome da empresa, solicitaram aos clientes o envio da identificação e da respectiva "password". A solicitação apareceu no "newsgroup" IRC a 23 de Junho, com os "piratas" a ameaçarem o corte da ligação para quem não divulgasse estas informações sigilosas. "Só em dois ou três casos os clientes forneceram as passwords, mas solicitaram imediatamente à Telepac que fossem mudadas, antes de serem usadas", disse ao Público Jose Silva Lopes, director de comunicação da empresa. "A sitaução está sobre controlo", disse o mesmo responsavel, adiantando que a Polícia Judiciária já está a investigar o caso para tentar descobrir os autores desta tentativa de burla que visava o uso em proveito próprio dos créditos de tempo das vitimas para acesso à Net.

12/07/97

`IN: RECORTES - 10/Julho/1997`

CASO MAIL.TELEPAC.PT: NOVAS REVELAÇÕES
Segundo uma fonte bem informada da Telepac, a explicação oficial dada para justificar os problemas no server de correio não estão totalmente correctas (ver Recortes do dia 3 de Julho). Recordamos que explicação oficial para o server ter estados quase três dias em baixo foi originado por um ataque de spamming (ou "spuming", como foi noticiado no jornal Público :). No entanto, a nossa fonte garantiu que tal nunca aconteceu tendo o problema sido originado pela sobrecarga dos dois servers. De facto, os servers de mail da Telepac já sofreram diversas actualizações de hardware para gerir o aumento de tráfego mas o software nunca foi actualizado. Nos últimos tempos já haveria sintomas de colapso - sobretudo nos fins de semana onde o tráfego é maior. Segundo a mesma fonte, a Digital Portuguesa apenas respondeu aos pedidos insistentes de assistência técnica ao fim de 27 horas - contrariando o estipulado no contrato de assistência que obriga a um tempo de resposta máximo de 4 horas. Na altura de fecho desta edição da Recortes não nos foi possível contactar nenhum responsável da Digital. Nos dias seguintes ao "estouro" e visto que os backups não funcionaram como era suposto, a recuperação de dados fez-se duma forma quase manual - o que, aliás, explica a morosidade e o que se passou com alguns leitores da Recortes: uns nunca receberam um número da Recortes, outros receberam-no várias vezes e outros receberam texto misturado com uma série de lixo.

CIENTISTAS DA IBM PROPÕEM NOVO MÉTODO DE ENCRIPTAÇÃO
Dois investigadores do IBM Almaden Research Center em San José, Califórnia, desenvolveram uma nova aproximação à criptografia de chave pública baseada em construções matemáticas chamadas lattices (em Português significa algo como "janela de grade"). O sistema é gerado numa série de hiper planos que constituem a chave privada e um método de geração de pontos próximos de um dos hiper planos para a chave pública. A segurança do sistema assenta na dificuldade de computar a menor distância que liga quaisquer dois pontos numa dada lattice. Não se preocupe se não percebeu a explicação matemática - o que isto significa no fundo é que este algoritmo é extremamente difícil de partir através de força bruta conferindo assim um grau de segurança superior aos algoritmos existentes.

10/07/97

Hackers causaram prejuízo de US$ 100 milhões
Fonte: ZAZ/IDG

Se você ainda acredita que hacker é apenas uma invenção da indústria cinematográfica, está na hora de mudar de opinião. Estudo conduzido pelo FBI junto ao Computer Security Institute (CSI), aponta que 75% de 563 especialistas em sistemas de segurança das maiores companhias americanas entrevistados relataram perdas financeiras no último trimestre devido a brechas nos sistemas de segurança das empresas em que trabalham.

As invasões dos hackers foram realizadas com intenção de fraudes financeiras, roubos de informações sigilosas e sabotagens usando vírus de computador. A soma dos danos a 249 companhias entrevistadas totalizou mais de US$ 100 milhões - em estimativa conservadora. "Boa parte das empresas ainda não sabe como reportar esse tipo de crime às autoridades e muitas não identificam sequer o ataque de hackers a seus sistemas", disse Patrice Rapalus, diretor do CSI.

Há outros dados importantes apontados pelo estudo. Aumentou em 10% o número de gerentes de CDP que citam a conexão de Internet como freqüente ponto de ataque dos hackers. Enquanto 43% dos entrevistados aponta que suas empresas foram atacadas por agentes externos entre 1 e 5 vezes, 45% dos questionários não esclarecem se esses ataques foram realizados interna ou externamente.

Mais de 60% das pessoas que responderam aos questionários dizem que não existe em suas companhias um responsável para agir em caso de emergência contra um ataque de hackers. Outra estatística gritante: apenas 17% dos casos de ataques contra os sistemas das empresas foram relatados às autoridades do país.

09/07/97

O server www.ejikman.go.id foi hackado pela UrBaN Ka0s Org.