[iwar] [fc:The.web's.most.wanted]

From: Fred Cohen (fc@all.net)
Date: 2002-08-01 19:44:30
Next message: Fred Cohen: "[iwar] [fc:openssh-3.4p1.tar.gz.distribution.recently.trojaned]"
Previous message: Fred Cohen: "[iwar] [NewsBits] NewsBits - 07/31/02 (fwd)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200208020244.g722iUH02558@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Thu, 1 Aug 2002 19:44:30 -0700 (PDT)
Subject: [iwar] [fc:The.web's.most.wanted]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

The web's most wanted 
 
The hacking community from Cardiff to California has declared war on cyber crime 
investigators who are led by the
FBI. Steve Bell reports
 
Steve Bell
Thursday August 1, 2002
The Guardian
 
The war against hackers is entering a new phase.  In the UK and the US,
behind the walls of usually bland-looking buildings and shielded from
wireless hacking by lead-lined walls, the stuff of Hollywood films is
being played out across giant plasma screens. 
 
Programmers, often working on behalf of government agencies, track,
monitor and frenziedly alter code in a bid to patch up vulnerable and
sometimes besieged networks. 
 
Details have emerged about a new technology, dubbed Magic Lantern, that
allows the FBI to record keyboard strokes by secretly planting a
software spy in a targeted computer.  Rumours have also surfaced about a
possible deal with a file-sharing network which would allow files to be
viewed by the Feds. 
 
The Bureau also has a shadowy position on European Union committees,
tussling with the task of developing a single cross-border cyber crime
unit. 
 
This ramping up of activity signals a new phase in the long-running
battle between hackers and law enforcement agencies.  An industry source
says BT Ignite is now tracking hackers across its UK and European
networks for, among others, both the White House cyber security team and
the FBI.  Chris McNab, technical director at the London-based Matta
Security, says the UK's National Hi-Tech Crime Unit is also embarking on
a busy round of partnership building in a bid to tap the superior
technical skills of private industry. 
 
Given this flurry of activity, you might be forgiven for thinking that
the cyber law enforcement outfits are on the verge of stamping out
hacking, cyber crime and cyber terrorism.  However, nothing could be
further from the truth.  In fact, a war is brewing and increasingly
irate hackers are the ones being tipped as victors.  Hackers are not
only incensed at what they see as an outrageous infringement of civil
liberties by some of the FBI moves, but are also disparaging about its
efforts to counter them. 
 
They are actively gearing up to launch their own attack against the
agency, and security industry experts claim the FBI doesn't have a
chance of winning. 
 
The reasons for the FBI's offensive are straightforward: the agency is
attempting to get a grip on hacking before it reaches overwhelming
proportions.  Gartner Group, computer industry analysts, estimates that
by next year, 20 million people worldwide will be actively hacking.  But
by admitting to developing technology such as Magic Lantern, the FBI is
also antagonising a global and powerful hacking community that does not
classify itself as either cyber criminal or cyber terrorist, but views
itself as a guardian of internet democracy. 
 
The development of Magic Lantern has caused a storm in the hacking
underground.  It is deemed unethical, highly dangerous and goes against
everything they claim to represent.  More surprisingly, this attitude is
reflected by some anti-virus vendors, who are also concerned at its
implications. 
 
Ironically, in developing Magic Lantern, the FBI sought inspiration from
Back Orifice: a trojan that could wreak havoc in Microsoft operating
systems.  Back Orifice was itself developed by hackers to, as one said,
"demonstrate what a total piece of crap Microsoft represents from the
security perspective and to publicise the danger of trojans to home
users."
 
"We are being sucked into an Orwellian nightmare," says one US-based
hacker who calls himself Oxblood Ruffin.  Oxblood, a member of the
influential hacking group Hacktivismo, adds: "This [Magic Lantern] is a
powerful tool and basically they have initiated a state-sponsored
trojaning campaign with no judicial oversight.  If you look at what's
possible it's very scary.  For instance, if there is no smoking gun, a
rogue cop could plant a virtual one.  It's possible to upload as well as
download or browse the contents of a targeted user's machine.  So if
there are no kiddie porn pictures [on a computer] for instance, they can
be uploaded and the doors kicked in five minutes later.  No traces
either."
 
Ruffin says the hacking community is coming together to battle the FBI
and predicts that even technology vendors will be throwing their own
weight in, too.  "It's cut a dividing line right through the anti-virus
community: it's a hugely divisive issue," he says.  He also predicts
that when the FBI unleashes its new tools, hackers are going to respond
with a ferocity never previously seen.  The last time hackers declared
war against government, massive denial of service attacks were launched
against the White House website, which had to close down for a day.  The
FBI website also had to shut down for several hours as defences were
rebuilt.  Several other websites, including the US Senate site, were
defaced with diatribes against the FBI.  The spark for the action was a
series of raids against several hackers belonging to a group known as
Global Hell.  The coming action will be "10 times" more intense, it is
claimed. 
 
But while hackers are incensed with the FBI's moves, they are also
dismissive of them.  A hacker who uses the handle Pink Reed says: "We
have more targeted experience than anyone in this area and the FBI has
stolen our idea.  They couldn't come in with their own - they don't have
the know-how.  If a hacker is any good, he will have a wealth of
home-grown tools and techniques with which he can do pretty much what he
wants.  The FBI doesn't have an idea - or a chance."
 
This attitude reflects the widely held belief among hackers that the
people charged with maintaining security are often little more than
amateurs.  And this is a view also held by experts on the other side of
the divide.  Chris McNab, a former ethical hacker, says: "Hackers have
time, resources and experience.  They are experts at finding
vulnerabilities and most of the time, the security industry is playing
catch up."
 
Even the FBI's attempts, if true, to break into music, text, image and
video files as they are transmitted across networks, look set to land
little more than a public relations victory. 
 
McNab adds: "If hackers are going be transmitting anything that might be
of use, it's certainly not going to be sent unencrypted. 
 
"They have been using encryption for years and it can take years to
unscramble the codes.  It's just not feasible." For the FBI to catch the
hackers, it must be sure of their identity and intent before they embark
on an attack. 
 
Both McNab and Ruffin agree that the FBI does not have the experience or
resources to combat hackers, despite working hard to assemble
partnerships with private industry over the past two years.  For
example, it holds daily briefings with Internet Security Services'
X-Force.  This is a team dedicated to defending its corporate clients
from attack, a team that uncovers 150 new attack methods every month. 
X-Force provides this and other information to the FBI, but the
discoveries are inevitably made after the attack. 
 
Ruffin speaks disparagingly about the private industry partnerships the
FBI has formed.  "A lot of them are highly paid with poor knowl edge:
the FBI does not have the best help in the world." McNab says of the
UK's National Hi-Tech Crime Unit: "It's a government organisation with
government salaries, how is it going to attract the best talent?"
 
Hackers won't be drawn on when a concerted effort will be made to
counter the FBI's strategy, but it is likely to be sparked with the
first arrest of a member of the hacking community through the use of
Magic Lantern, and attacks are likely to be launched from Cardiff to
California. 
 
What must be worrying for the FBI are the hacking tools that they are
not aware of.  Even inexperienced hackers have access to techniques that
are devastatingly destructive.  For example, techniques exist that allow
programs to be planted on a hacked website.  Every user that enters that
site will unwittingly run the program, which will lie dormant until 3am. 
It then automatically uninstalls any firewall around that computer or
network, replacing it with malicious code that completely wipes the hard
disk. 
 
And the hard facts are that a hacker can break into any computer and -
unless they are incompetent - they will remain undetected.  Most
hackers, when launching an attack, will route the attack through five or
six computers that could be scattered around the globe.  A favoured
option for attacks launched from the UK and the US is to ensure the
launch computer is often located some distance away, such as in Korea. 
Cyber crime units could determine its location as a result of its
Internet Protocol (IP) address, but then they would need to speak to the
ISP in Korea, send people out to Korea, get a warrant to retrieve the
logs and audit recent movements to see if more attacks originated from
that computer - and only then move in to make the arrests.  And there is
a very high chance that the owner of the computer is completely unaware
his machine is being used to launch the attack. 
 
The process would need to be repeated for each computer and, if the
hacker is experienced, the same computer would never be used again to
launch an attack.  If the attack was traced to a UK ISP, the whole
process and appeals to judiciary would need to be repeated with the very
good chance that the targeted computer was a hijacked machine.  Given
that hackers have millions of computers from which to choose, the
efforts of law enforcement are effectively reduced to little more than a
hope and a prayer. 
 
Oxblood Ruffin, although keen to stress his law-abiding credentials,
says: "There is a lot of arm waving when some one gets caught as though
they were the greatest criminal since Professor Moriarty.  People who
get caught just aren't that good at what they do."
 
Even the technology used to track hackers in real time has its
limitations.  While it provides the ability to defend against attacks as
they take place, it can only track hackers as they move forward through
networks to the point of attack.  To snare the hacker, trackers must be
absolutely sure about where the attack originates from.  And seasoned
hackers are notoriously adept at covering their tracks. 
 
Despite the sense of indignation in the hacking community, there is also
a feeling of confidence that its best efforts can easily be countered. 
McNab believes this too and says: "They will get around it." He points
out that law enforcement "really does have some problems at the moment
in combating hackers, and the bottom line is that nothing can stop a
determined hacker."
 
The danger for the FBI and other cyber crime outfits is that when
hackers decide to act, they can hit out - and they can hit out hard. 
 
Guardian Unlimited � Guardian Newspapers Limited 2002

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:openssh-3.4p1.tar.gz.distribution.recently.trojaned]"
Previous message: Fred Cohen: "[iwar] [NewsBits] NewsBits - 07/31/02 (fwd)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2002-10-01 06:44:32 PDT