Kuji Media Corporation Ltd.

EuroKom IT Security Seminar

Thursday 18th October, 2001

CEO’s and IT Managers from over fifty companies and organisations attended the EuroKom IT security seminar, which was held on 17 October in Citywest, Dublin. The seminar was opened by Noel Treacy, TD Minister for Science and Technology who told the attendees that ‘Confidence in IT Security is crucial to the success of eBusiness.’ Minister Treacy went on to elaborate on the actions that the Government are taking as a pro-active approach to meeting the challenges and opportunities which the digital economy presents. (The full text of the Minister’s speech can be viewed here.)

Brian Lynch, EuroKom’s Sales and Marketing Director, announced a partnership with Celare Ltd, one of Northern Ireland’s leading providers of IT Security Services. Brian stated that through this collaboration with Celare, EuroKom could now offer a unique range of corporate communications and security solutions throughout Ireland.

Keynote speaker at the seminar was Matt Bevan, otherwise known as ‘Kuji’, a reformed hacker who was quoted by the FBI as having ‘?created more harm than the KGB.’ Kuji, then a computer student, is alleged to have penetrated the US Air Force computer systems in 1994. He did it in the back bedroom of his parent’s home near Cardiff in Wales using a computer that his parents had given him for his 16th birthday. Kuji is also alleged to have hacked into NATO and NASA computer systems. In one case, he is also said to have hacked into the US FLEX system (Force Level Execution) and had the power to fire a Peacekeeper missile with a payload of 150 kilotonnes. Newspaper headlines at the time claimed that he ” Could have Started World War 3″ and that he “Even knew Mel Gibson’s Credit card number”. To this day, he believes that his e-mail, ordinary mail and telephones are still monitored by the Pentagon. (In 1994, there were 38,000 intrusions into Pentagon computers of which only 900 were detected.)

Foreign hackers working from overseas via the Internet penetrated sensitive U.S. Government computer systems.

Hacking U.S. Government Computers from Overseas

Foreign-based hacker groups working via the Internet have had substantial success breaking into U.S. Government and defense contractor computer systems holding sensitive but not classified information. There is one publicly known case in which computer break-ins from overseas were sponsored by a foreign intelligence service.

Three Germans in Bremen, West Germany were hired by the Soviet KGB during 1986- 1989 to hack into U.S. Government systems. They penetrated Pentagon systems, NASA networks, Los Alamos National Laboratories and Lawrence Berkeley Laboratories. They were detected by Clifford Stoll, at Berkeley, when he checked out minor discrepancies in the account billings. Stoll later wrote the popular book, The Cuckoo’s Egg, about the case. The three hackers were arrested and convicted of espionage.

The following three cases also show the ability of hackers overseas to penetrate protected domestic U.S. systems via the Internet. In these three cases there was some suspicion of possible foreign intelligence involvement. This could not be confirmed, but also could not be ruled out. Enterprising foreign hackers could collect this information on their own and then sell it to a foreign intelligence service, or a foreign service could sponsor the same kind of operation itself.

Argentine Hacker Intrusion Into Navy Systems

In July 1995 computers in several states and Mexico reported intrusions originating from Harvard University. The hacker apparently lifted user IDs and password information from accounts on a system administered by the university. The U.S. government became concerned in August when an intrusion was detected on a network operated by the U.S. Naval Command, Control and Ocean Surveillance Center (NCCOSC). The intruder broke into the NCCOSC computer and installed sniffer programs to capture the IDs and passwords of legitimate users, and other software that would allow him to alter or destroy network files or to make them inaccessible to users.

After attacking a site in Taiwan, the intruder was monitored while “chatting” on the Internet, using the name Griton. Griton was traced back to Argentina where the moniker was known by Argentine authorities as a computer pirate who specialized in hacking, cracking and phreaking. The subject was soon traced to Buenos Aires and identified as Julio Cesar Ardita, then a 21-year-old student in Buenos Aires at the University of Argentina.

According to news reports, this hacker gained access to a host computer at the Army Research Lab in Edgewood, Maryland; the Naval Research Laboratory in Washington; the California Institute of Technology in Pasadena, California; and the NASA Jet Propulsion Laboratory. Victim sites include 62 U.S. government, 136 U.S. educational, and 31 U.S. commercial facilities. The U.S. Navy, NASA, and Department of Energy’s National Laboratories were high on the list of frequency of penetration.

Ardita was served a warrant and his computer was seized. He admitted responsibility, but claimed he was guilty only of mischief. He was arraigned in December, 1995. The U.S. Department of Justice filed criminal charges against Ardita. Prosecution in the U.S. was initially frustrated by the fact that computer crime is not covered by international agreements for extradition. In December 1997, Ardita agreed to come voluntarily to the United States and plead guilty to unlawfully intercepting electronic communications over a military computer and damaging files on a military computer. In return for Ardita’s agreement to come voluntarily to the United States, he is being sentenced to only three years probation and fined $5,000.1

Although he hacked into important and sensitive government research files on satellites, radiation, and energy-related engineering, Ardita is not accused of obtaining classified information related to national security. To counterintelligence analysts, the hacker’s selection of targets and subject matter suggested a well-defined intelligence collection tasking, but foreign intelligence involvement has not been established. If a foreign intelligence service was involved, it is impossible to know which one, as many countries might have been interested in the information Ardita collected.

The Ardita case was the first time a court-ordered wire tap was used for real-time monitoring of an unknown subject to catch a computer criminal. It demonstrates the ability to chase and identify an international hacker on-line.1

Air Force Rome Development Center Break-In

Two young British hackers, Richard Pryce, age 16, and Mathew Bevan, age 21, broke into U.S. military computer systems. Pryce, who was identified and charged in 1995, allegedly obtained access to files on ballistic weapons research and messages from U.S. agents in North Korea during a 1994 crisis over inspection of nuclear facilities in North Korea. The penetrations were carried out over a period of several months.

Bevan, an information technology technician, was charged in 1996 with conspiracy to gain unauthorized access to computers. Pryce used the on-line nickname of “Datastream Cowboy” while Bevan identified himself as “Kuji.” Kuji was tutoring Datastream in his attempts to break into specific systems. According to news reports, investigators suspected the older culprit of being a foreign agent.

Pryce and Bevan broke into the Rome Air Development Center, Griffiss Air Force Base, NY, and before authorities became aware of their presence (five days later) they had penetrated seven systems, copied files including sensitive battlefield simulations, and installed devices to read passwords of everyone entering the systems. Rome Air Development Center was used as a launching pad for more than 150 intrusions into military, government and other systems including NASA and Wright-Patterson Air Force Base. Large volumes of data were downloaded from penetrated systems. One such data transfer (which was being monitored) involved the downloading of files from the Goddard Space Flight Center to an Internet provider in Latvia. In order to prevent the loss of sensitive data, the monitoring team broke the connection.

In one of these break-ins, Pryce used Rome to access a Korean facility. According to media reports, “For several anxious hours [U.S. authorities] didn’t know whether the intrusion was into a North or South Korean system. The concern was that the North Koreans would trace an intrusion coming from the U.S. and perceive it as an aggressive act of war.” The penetrated system turned out to be the South Korean Atomic Research Institute. The two were arrested after a long investigation by the Air Force Office of Special Investigation and New Scotland Yard.2

Dutch Teen Hackers

A group of Dutch teenagers penetrated computer systems at 34 U.S. military installations during 1990-91. They gained access to information on personnel performance reports, weapons development, and descriptions of movement of equipment and personnel. The systems penetrated included the Naval Sea Systems Command, the Army’s readiness system at Ft. Belvoir, Virginia, and the Army missile research lab at Aberdeen, Maryland.

At least one penetrated system directly supported U.S. military operations in Operation Desert Storm prior to the Gulf War. They copied or altered unclassified data and changed software to permit future access. The hackers were also looking for information about nuclear weapons. Their activities were first disclosed by Dutch television when camera crews filmed a hacker tapping into what was said to be U.S. military test information.

According to an ABC News report, the Dutch hackers had been operating for at least a year reading sensitive information about military plans and operations. Documents obtained by ABC indicate that hackers got so much information about the Patriot Missile that they had to break into several other computers just to find a place to store the data. At one point the intruders shut down computers in Wisconsin and Virginia which were later used to mobilize troops for Desert Storm. Information was gathered on the Patriot rocket launching system, the Navy’s Tomahawk cruise missile, and on the call up of military reserves for the Gulf War. The search words the hackers were particularly interested in were “military,” “nuclear” and “Desert Storm” or “Desert Shield.”

Many of the computer penetrations originated in Geldrop, Holland. At the time, investigators suspected the hackers could have been freelance spies looking for information to sell to the KGB or Iraqi intelligence, but no evidence of foreign intelligence service involvement has been found.

Cracking down on the outlaws of cyberspace Cybercop apprenticed in tough job
( USA TODAY )

What’s it take to be America’s top cybercop?

“I was a hockey referee, so I’m used to being beaten up,” suggests Jim Christy, who is among those most often mentioned for the title.

And he’s been at it for only a decade.

But it’s a decade that’s seen the Internet grow from 8,000 users to an expected 50 million at the end of this year. And it’s a decade that’s seen computer crime go from a Hollywood scriptwriter’s fantasy to a real- life threat to commerce.

As a result, it’s seen Christy trade a higher-paying post as a Pentagon computer programmer to become the military’s first full-time civilian computer crime investigator.

Today, with the weighty title of Chief of Computer Crime Investigations & Information Warfare, he is one of 68 computer investigators in the Air Force Office of Special Investigations (OSI).

At 44, Christy’s part-time career as a professional hockey official has ended after four knee operations and a bionic eye implant necessitated by a slap shot to the head.

What he misses most, he says, is that as a referee “you are judge, jury and executioner, and justice is immediate.”

In law enforcement, justice is dispensed slowly. Especially, he notes, in cyberspace.

Christy, a Baltimore native, stumbled into the computer field. After drawing No. 35 in the draft lottery of 1971 during the Vietnam War, he joined the Air Force rather than waiting to be drafted. The aptitude test noted computer skills. He spent the next four years as a computer key punch operator, followed by 13 years as a civilian working computers at the Pentagon.

When he moved to OSI, Christy largely ceased his hands-on involvement with computers and systems.

“There are a whole lot of people who do that stuff a lot better than me,” he says.

His role now is to guide investigations — how to track the cybercriminals, who to talk to, when to get a warrant.

Christy has more experience chasing outlaws through cyberspace than anyone else. To those knowledgeable about computer crime and hackers, his cases are legend:

– He was the first investigator to take seriously Cliff Stoll’ s complaints about a 75-cent accounting error that led to the discovery of a hacker mucking about in the University of California-Berkeley computer.

The 1986 investigation eventually led to Hanover, Germany, and a group of students who were hacking into U.S. military systems and selling what they found to the Soviet KGB. Stoll describes the case in the book, The Cuckoo’s Egg.

– Christy took part in the “Morris Worm” investigation, helping track Robert Morris, whose program moved across the Internet entering and disabling individual computers and network systems, causing millions of dollars in losses.
– Christy helped solve a 1991 murder by using cardboard and tape to reassemble two floppy disks.

On the disks were love letters between Air Force Sgt. Joe Snodgrass and a lover; a letter to a pair of hitmen paid to kill Snodgrass’ wife; and a letter increasing life insurance coverage for his wife to $450,000. Snodgrass pleaded guilty and is serving life in prison.

– Christy helped solve a 1991-92 case of an Air Force colonel who used America Online to exchange child pornography with 88 others. The case yielded the first cyberspace search warrants. The colonel was convicted and dismissed from the military; no jail time was imposed.
– Christy worked on the 1994 Rome Labs case, in which a British teen-age hacker, with the guidance of a still-unidentified accomplice, cracked the security at the Rome Air Force Base in New York. The base is a premier military research facility, and the unidentified accomplice is suspected of being a foreign agent.

After weighing a series of high-tech options for chasing the hackers through cyberspace, Christy found an informant in an on-line chat room who led him to the British hacker. Charges are pending.

Since last fall, Christy has been on temporary assignment to the Senate Permanent Subcommittee on Investigations, helping them examine security in cyberspace.

“I like working up on Capitol Hill, because you can make a difference, ” Christy says.

“It’s still anarchy and like the Wild West out there on the Internet, ” he continues. “But I feel much better now than I did just a year and a half ago, because the decision makers are starting to take notice. ”

Three landmark cases

In the brief history of computer crime, these three cases are regarded as landmarks:

CITIBANK BREAK-IN: Bank robbery by hackers still rare

In 1994, Citibank came under attack by a group of cyberspace thieves, led by a mathematician in St. Petersburg, Russia.

In response, the bank called SAIC, a leading international security firm in McLean, Va. SAIC eventually traced the funds to accounts in San Francisco; Amsterdam, the Netherlands; Germany; Finland; and Tel Aviv, Israel.

The attackers had worked at Citibank affiliates for up to three years before the thefts. They installed backdoors to the computer and entered when they were ready.

Eventually, all but $400,000 of the $10 million stolen was recovered, and the company tracked down the intruders. Only then was the case turned over to the FBI, which arrested Vladimir Levin and four accomplices.

It remains the only case of a computer theft reported by a bank, the FBI recently told Senate investigators.

SAIC, whose board of directors and executive offices are populated by former high-ranking members of the military and intelligence community, declined comment.

According to the FBI, Levin took advantage of accounts where clients had opted for a lower level of security. All Citibank clients are now required to use higher- level security. Levin is battling extradition to the USA.

When the case hit the media in 1995, 20 of Citibank’s largest clients were approached by other banks with claims of better security, according to a recent report by the Senate Permanent Subcommittee on Investigations.

“There’s a huge disincentive to reporting these crimes,” says Mark Rasch at SAIC’s Center for Information Protection.

ARGENTINE HACKER: A tap on the Net spreads a wide net

In an investigation this past winter, authorities obtained the first court-ordered cyberspace wiretap.

The case underscores the complexities of preserving privacy rights in cyberspace.

The case involved a hacker using a Harvard University computer to steal passwords and gain access to government computers.

The problem: how to track the hacker in Harvard’s computer without listening to all the system activity, up to 300 users at a time.

Unlike a traditional wiretap, where authorities listen to a single conversation on a single phone line, in cyberspace police must review all the traffic on a system to identify the intruder’s packet of digital information.

“It’s like putting a bug (listening device) on home plate at Yankee Stadium and listening to every conversation and having to parse out the one conversation you’re looking for,” says Donald Stern, U.S. Attorney in Boston.

Investigators were able to draw a distinct profile of the intruder, such as specialized software he used. Authorities used software that monitored the Harvard system looking for that profile, alerting agents when they had a near match.

Even so, investigators twice read unrelated conversations. Authorities concede a clear profile is needed to preserve privacy rights.

“There will be cases where, no matter what you do, you will be unable to get a clear enough profile of the intruder,” says Stephen Heymann, the deputy chief of the U.S. Attorney’s criminal division in Boston.

By late December 1995, authorities say, the intruder was traced to Buenos Aires, Argentina, and identified as Julio Cesar Ardita, a computer science student. He faces U.S. charges, but Argentina won’t make an arrest.

INTEL CHIP CASE: Pentium prosecution required creativity

One of the rare cases of economic espionage that ended with a prosecution was that of Guillermo “Bill” Gaede, who pleaded guilty in March to charges of stealing the specifications for Intel’s Pentium and 486 computer chips.

Court papers set the value of the theft at $10 million to $20 million; Intel says the value could go up to $300 million.

“This is as big a case as anything we’ve seen in the ’90s,” says Leland Altschuler, chief of the U.S. Attorney’s Office in San Jose, Calif.

The Gaede case, while unique in its dimensions, was typical in another respect: It was an “inside” job, pulled off by a trusted employee with access to the computer system.

As a senior engineer at Intel in 1993-94, Gaede was able to access Intel’s computer system from his home computer.

However, Intel’s security system prevented anyone from copying files.

So Gaede set up a video camera and taped the blueprints off his computer monitor.

He sent a copy of the videotape to an Intel competitor. Instead of paying Gaede, the competitor promptly sent the video back to Intel and alerted authorities.

Intel tracked Gaede to Argentina, where the company initiated legal action. In the USA, Intel worked with the Justice Department to produce indictments against Gaede.

Gaede was captured when he returned to the USA in September 1995 to visit relatives. But, because Gaede only made a videotape of a computer file and never really stole anything in the physical sense, authorities had trouble deciding how to charge him.

Gaede pleaded guilty to mail fraud and interstate transportation of stolen property. In June, he received a 33-month sentence.

Copyright 1996, USA TODAY, a division of Gannett Co., Inc.

M.J. Zuckerman, Cracking down on the outlaws of cyberspace Cybercop apprenticed in tough job., USA TODAY, 07-02-1996, pp 04B.

Address by Paul Rodgers
Commissioner, President’s Commission on Critical Infrastructure Protection

Before the Annual Meeting and Utilities/Government Agency
Emergency Training Pilot Program
California Utilities Emergency Association

Sacramento, California
May 28, 1997

A New World of Risk

Good Afternoon:

Cyber Threats

The Rome Laboratory in New York is the Air Force’s premier command and control research facility which works on very sensitive projects such as artificial intelligence and radar guidance. In March and April 1994, a British hacker known as “Datastream Cowboy,” and another hacker, called “Kuji,” attacked Rome Lab’s computer systems over 150 times.

The hackers stole sensitive air tasking order research data. These orders are the messages military commanders send during wartime to pilots to direct and integrate their attacks on a daily basis. The hackers also launched other attacks through the lab’s computer systems, gaining access to systems at NASA’s Goddard Space Flight Center in Greenbelt, Maryland, Wright-Patterson Air Force Base in Dayton, Ohio, and defense contractors around the country.

Datastream Cowboy was arrested in Great Britain by Scotland Yard, but Kuji was never caught. Therefore, no one knows what happened to the data stolen from the Rome Lab.

The Rome Lab’s intrusion dramatically depicts the vulnerability of the computer age — the most far-reaching technological development of all time. The intrusion lends credence to such movies as “War Games” where a teenage hacker breaks into a Defense computer and creates great mischief.

A true story on such intrusions is told by Cliff Stoll in The Cuckoo’s Egg, a New York Times bestseller, which involved the tracking of a KGB spy ring in Hannover, Germany, from the Lawrence Berkeley Laboratory through the maze of computer espionage.

Every aspect of our society is becoming linked to computer networks — from civilian government and the military, to public utilities, communications, transportation, and financial systems. These links are creating vast efficiencies in the delivery of goods and services and are giving people throughout the world greater access to information, ideas and each other. These links transcend national boundaries: Beijing and Baltimore are within a keystroke of each other.

However, as we have seen, the benign aspects of the Internet carry with them the deadly germs of vulnerability. The Government Accounting Office estimates that the Defense Department alone annually experiences over 250,000 attacks on its computers. COAST (Computer Operations, Audit, and Security Technology) at Purdue University reports that 99% of all major companies experience at least one computer incident a year, and that telecom and computer fraud and loss total almost $10 billion a year. Our computer information systems are vulnerable to electronic penetration, manipulation and damage by a range of adversaries such as teenage hackers, disgruntled employees, organized crime and hostile foreign governments.

The ground rules have changed, and the battlefield is now economic, ethnic, religious and nationalistic rather than ideological, but espionage in the 1990s springs directly from the ruins of the Cold War spy regimes. Newly configured, the secret operations of America’s enemies threaten to hollow out the U.S. economy and siphon away the jobs and technologies we need to remain competitive in the 21st century.

In the past, armies had to march, navies had to sail and air forces had to fly for great damage to be done. Today, we live in an age where the ability to induce terror comes in miniature. We are now engaged in a war that will never end. As better defenses are built, new methods of attack will be devised in an effort to penetrate them.

Since biblical times, crimes have been deterred by the prospects of punishment. Yet, information crimes, under our existing legal and enforcement regime, may sometimes have the unique characteristic that apprehension is impossible.

Physical Threats

Our critical infrastructures are threatened by terrorist bombings such as those that occurred at the New York World Trade Center in 1993 and Oklahoma City in 1995, and by natural disasters such as hurricanes, earthquakes, floods and tornadoes. The New York terrorists had even bigger plans for coordinating attacks against New York City’s bridges and tunnels and the bombing of airlines over the Pacific Ocean, but fortunately these plans were thwarted by their arrest.

The President’s Commission on Critical Infrastructure Protection

In view of those continuing threats, the President has established the President’s Commission on Critical Infrastructure Protection (PCCIP). The infrastructures include energy, financial, telecommunications, transportation and water systems, continuity of government, and emergency services such as medical, police, fire and rescue. These critical infrastructures are the life support systems of our society. They give us pure water, safe highways and airways, reliable energy, instant communications, and secure financial transactions.

The President defined these threats as: first, physical threats to tangible property; and, second, threats of electronic, radio-frequency or computer-based attacks on information or communications components that control critical infrastructures, known as “cyber threats.”

The Commission is composed of twenty Commissioners. Its Chairman is Robert Marsh, a former 4-star Air Force General and the former Chairman of the Board of a Fortune 500 company. Commissioners were nominated by each of the following ten Federal agencies:

Department of Commerce
Department of Defense
Department of Energy
Department of Justice
Department of Transportation
Department of the Treasury
Central Intelligence Agency
Federal Bureau of Investigation
Federal Emergency Management Agency
National Security Agency

One commissioner from each of the agencies will be from outside the Federal Government to emphasize the need for cooperation between the government and private sectors. Also, the President is now in the process of establishing a fifteen-member Advisory Committee composed of representatives from the private sector. Building a partnership between the public and private sectors is the core of the Commission’s work. As Henry Ford said: “Coming together is a beginning; keeping together is progress; working together is success.”

The basic mission of the Commission is to advise and assist the President by recommending a national strategy for protecting and assuring critical infrastructures. The Commission will identify physical and cyber threats, consider vulnerabilities, and develop policy and legislative options necessary to effect the recommendations. The Commission will file its report with the President on October 13 of this year and then await his response.

Local Officials

The Commission and the California Utilities Emergency Association (CUEA) have a great deal in common in our efforts to enhance our critical infrastructures.

America’s utilities are among our most critical infrastructures, and the work of CUEA is in the vanguard of efforts to assure their continued high performance. We hope that the work of CUEA will be duplicated in other states which have not yet established similar organizations. We urge that CUEA increase its focus on means to address the cyber threats of its members.

The members of your Association are the ones closest to the scene in responding to threats or damage to our critical infrastructures. How can their role be made more effective? How can we build more efficient means to share threat and vulnerability information with local officials and the private sector?

There are few jurisdictions in which the first responders feel adequately trained and equipped to meet chemical, biological and radiological incidents. They often do not have the sensors to identify their encounters with such agents. They often do not have adequate decontamination equipment or adequate protective gear to assure their own safety in dealing with such an incident.

How can Federal agencies provide increased training to assist local officials in responding to such incidents? Should specialized equipment be furnished to assist in detection, mitigation and recovery?

Much of the information that controls critical infrastructures such as energy and telecommunications is transmitted through computers, i.e., through the public telephone net, and increasingly, the Internet. Yet there are no uniform standards governing this service. Should standards be established? Who should establish them? What should the standards be, and how might they be enforced? Or, should they be voluntary like the seal of approval of the Underwriters’ Laboratory?

Conclusion

We welcome and encourage your input. The toughest work of the Commission is still before it — the actual crafting of strategy — so we want to hear what you have to say as soon as possible. That’s the only way we can devise solutions that work for everyone.

We must never forget that in this age, as in all ages, success is determined by the ability to cope with change. As Thomas Stearns Eliot observed:

Last season’s fruit is eaten
And the full-fed beast shall kick the empty pail.
For last year’s words belong to last year’s language
And next year’s words await another voice.

Working together, we can solve these pressing problems. It will take good minds, high dedication, and perseverance.

04/04/98 THE SCHOOLBOY SPY.

By Jonathan Ungoed-Thomas

The Americans called him their No 1 enemy, but he was only 16. Jonathan Ungoed-Thomas reveals one of the strangest stories of the cyber-age. On the evening of April 15, 1994, six American special agents sat in a concrete basement at a secret air force base patiently waiting for an attack. Their unseen and unknown enemy had for weeks been rampaging across the Pentagon network of computers, cracking security codes and downloading secret files.

Defence officials feared the infiltrator was a foreign agent. They were monitoring his movements in a desperate effort to trace him to his lair. He had first been spotted by a systems manager at the Rome Laboratory at the Griffiss air base in New York state, the premier command and control research facility in the United States. He had breached the security system and was using assumed computer identities from the air base to attack other sites, including Nasa, Wright-Patterson air force base – which monitors UFO sightings – and Hanscom air force base in Massachusetts. He was also planting “sniffer files” to pick up every password used in the system. This was a new type of warfare, a “cyber attack” at the heart of the most powerful military machine on earth. But the American military had been preparing for “cyber war” and it had a new breed of agent ready to fight back against the infiltrator. Computer specialists from the Air Force Office of Special Investigations (AFOSI) and the Air Force Information Warfare Centre in San Antonio, Texas, were dispatched to Rome Laboratory to catch the attacker.

By the end of the second week of their attempt to outwit him, their windowless basement room was a mess of food wrappers, sleeping bags and empty Coca-Cola cans. Sitting among the debris, the American cyber agents saw a silent alarm throb on one of the many terminals packed into the 30ft by 30ft room. Datastream Cowboy, as he called himself, was online again. They carefully tracked him on a computer screen as he used the access code of a high-ranking Pentagon employee to sign on. This gave him the power to delete files, copy secret information and even crash the system. As he sifted through battlefield simulation data, artificial intelligence files and reports on Gulf war weaponry, the agents worked frantically at their terminals, trying yet again to establish who he was and where he had come from. It was futile. Datastream Cowboy always bounced around the world before launching an attack and it was impossible even to establish in which country he was sitting.

Suddenly he left the Pentagon system. The agents rapidly checked the computer address of his new target and were chilled by the result: he was trying to get access to a nuclear facility somewhere in Korea. The shocked agents saw a terrible crisis coming. The United States was embroiled in tense negotiations with North Korea about its suspected nuclear weapons programme. The Clinton administration was publicly split between a faction that wanted to punish the Stalinist regime in Pyongyang for attempting to develop a nuclear bomb and State Department diplomats who insisted on a gentler approach.

If the paranoid North Koreans detected a computer attack on their nuclear facility from an American air base – because Datastream Cowboy had assumed an American military identity by routeing his assault through the Griffiss computer – they would be bound to believe that the hawks had won and this was an act of war. Senior defence officials were hurriedly briefed as the agents attempted to establish the exact location in Korea of the computer that Datastream Cowboy was trying to crack.

After several tense hours, they had their answer. His target was in South Korea, not North. The security alert was over, but the damage meted out by Datastream Cowboy was not. In the space of a few weeks he had caused more harm than the KGB, in the view of the American military, and was the “No 1 threat to US security”.

What made Datastream Cowboy so dangerous, in the view of the Americans, was that he was not alone; he was working with a more sophisticated hacker who used the “handle” of Kuji. The agents repeatedly watched Datastream Cowboy unsuccessfully attack a military site and retreat for an e-mail briefing from Kuji. He would then return and successfully hack into the site. Both Datastream Cowboy and Kuji were untraceable. They were weaving a path through computer systems in South Africa, Mexico and Europe before launching their attacks. Over 26 days, Datastream Cowboy and Kuji broke into the Rome Laboratory more than 150 times. Kuji was also monitored attempting an assault on the computers at Nato headquarters near Brussels. It was only three years after the final collapse of Soviet communism, but there was already a strong fear within the American government that the United States had become vulnerable to a new military threat: electronic and computer warfare.

Both America’s superpower military arsenal and its huge civilian economy had become reliant on microchips and in the words of Jamie Gorelick, a deputy attorney-general: “Some day we will wake up to find that the electronic equivalent of Pearl Harbor has crippled our computer networks and caused more chaos than a well placed nuclear strike. We do not want to wait for that wake-up call.”

What made the American military so vulnerable was that the Internet – the computer communications system that had been developed by Pentagon scientists as a tool for survival after nuclear war – was opening up in 1994 to anyone in the world who had access to a cheap and powerful personal computer.

The Internet automatically brought hackers to the very gates of the Pentagon’s most secret files – and it could not be policed, as it had been deliberately set up without controls to ensure ease of access for nuclear survivors.

According to official American figures, the Pentagon’s military computers are now suffering cyber attacks at the rate of 250,000 a year and it is retaliating with a $3.6bn programme of computer protection to key systems. THE attacks by Datastream Cowboy and Kuji were the opening shots in this barrage, and the Pentagon generals insisted that they had to be found and put out of action. It would have been relatively simple to shut them out of the Pentagon network, but they would survive to attack again – and their identities and the information they had already stolen would have remained unknown. The American cyber agents were ordered to continue chasing them through the electronic maze.

But how? They used a process called “fingering” in which they tried to detect every computer that Datastream Cowboy had used as stepping stones before attacking them. A computer on the Internet gives its own address in the first few bytes of any communication and the agents tried to trace Datastream Cowboy’s path backwards. The process can often be hit and miss because of the vast amount of traffic on the Internet and the hacker’s path was simply too long and circuitous to follow to its end. The agents almost gave up hope. Then old-fashioned police work was brought to bear. In the cyber age, where do hackers hang out? On the Internet, of course. They “chat” with each other through their screens.

The agents had informants who cruised the Internet and one of these made the breakthrough. He found that Datastream Cowboy hung out at Cyberspace, an Internet “service provider” based in Seattle. Moreover, he was a particularly chatty individual who was eager to engage other hackers in e-mail conversation. Naive, too. Before long, the informant had established that Datastream Cowboy lived in the United Kingdom. He even gave out his home telephone number.

Jubilant, a senior AFOSI agent contacted the computer crime unit in Scotland Yard for assistance. Datastream Cowboy’s number was traced to a house in a cul-de-sac in Colindale, part of the anonymous north London suburbs. In cold war days it would have been a classic address for a spy’s hideaway.

Telephone line checks revealed that the hacker was first dialling into Bogota, the Colombian capital, and then using a free phone line from there to hack his way into the sensitive military sites.

American agents flew to London and staked out the address with British police officers. Detectives were cautious, however, about making an immediate arrest because they wanted Datastream Cowboy to be online when they entered the house, so that he would be caught in the act.

At 8pm on May 12, 1994, four unmarked cars were parked outside the Colindale house. Inside one of them, a detective’s mobile phone rang. An agent from the Rome Laboratory was on the other end: Datastream Cowboy was online. Officers made a second call to British Telecom in Milton Keynes and established that a free phone call was being made to South America. Posing as a courier, one of the officers knocked on the door. As it was opened by a middle-aged man, eight policemen silently appeared and swept into the house. The officers quietly searched the downstairs and first floor. Then, creeping up the stairs to a loft-room, they saw a teenager hunched in his chair tapping frantically away on the keyboard of his ?700 PC World computer. They had found Datastream Cowboy.

One of the detectives walked up silently behind the young suspect and gently removed his hands from the computer. For 16-year-old Richard Pryce, a music student, it was the shock of his life. He looked at the policemen as they prepared to arrest him and collapsed on the floor in tears.

“They thought they were going to find a super-criminal and they just found me, a teenager playing around on his computer,” says Pryce now. “My mother had noticed people sitting outside our house for a few days beforehand, but I didn’t think much of it. I never thought I would get caught and it was very disturbing when I did.

“It had just been a game or a challenge from which I had got a real buzz. It was unbelievable because the computers were so easy to hack, like painting by numbers.”

Pryce, who was then a pupil at The Purcell School in Harrow, Middlesex, was arrested at his home but released on police bail the same evening. Five stolen files, including a battle simulation program, were discovered on the hard disk of his computer. Another stolen file, which dealt with artificial intelligence and the American Air Order of Battle, was too large to fit on to his desktop computer. So he had placed it in his own storage space at an Internet service provider that he used in New York, accessing it with a personal password.

During the subsequent police interviews, one pressing question remained unanswered: who was Kuji? Pryce claimed he had only talked with his hacking mentor on the Internet and did not know where he lived. American investigators regarded Kuji as a far more sophisticated hacker than Datastream. He would only stay on a telephone for a short time, not long enough to be traced successfully. “Kuji assisted and mentored Datastream and in return received from Datastream stolen information…Nobody knows what Kuji did with this information or why it was being collected,” agents reported.

Mark Morris, who was then a detective sergeant with Scotland Yard’s computer crime unit, was one of the investigating officers on the case. “It was awesome that Pryce, who was just one teenager with a computer, could cause so much havoc, but the greater worry in the US was about Kuji,” says Morris. “The fear was that he could be a spy working for a hostile foreign power. The job was then to find him.”

Pryce did give detectives one telephone number, but it was a red herring: a school library in Surrey. During the next two years of compiling evidence in Britain and America in the case against Pryce, British detectives and American agents failed to turn up any evidence that might lead to Kuji. Their break finally came in June 1996 when the computer crime unit decided to sift once again through the mass of information on the hard disk of Pryce’s computer.

Morris took on the job. “I was at home with my laptop and went through every bit of that hard disk, which was a huge task.” It took him three weeks. If all the files had been printed out they would have filled 40 filing cabinets.

At last he found what he wanted. “At the bottom of a file in the DOS directory I saw the name Kuji. Next to the name was a telephone number. Pryce might not have even known it was on his system because he downloaded so much information.”

For American agents hoping to catch a superspy, Kuji’s telephone number was a grave disappointment. He was based in Cardiff. A team of officers drove up to his address, a terraced house, and finally discovered Kuji’s identity. He was 21-year-old Mathew Bevan, a soft-spoken computer worker with a fascination for science fiction. His bedroom wall was covered with posters from The X Files and one of his consuming interests was the Roswell incident, the alleged crash of a UFO near Roswell, New Mexico, in July 1947. He was arrested on June 21, 1996, at the offices of Admiral Insurance where he worked.

“I would never have been caught if it wasn’t for Pryce and even then they took two years to find me,” Bevan says now. “And the only reason Pryce got caught was that he gave his number to a secret service informant.” Bevan, the son of a police officer, said he had not even been alarmed when Datastream Cowboy disappeared from the Internet. “Everyone was joking with me on the e-mail that he must have been arrested, but I didn’t believe it. It wasn’t until a year later that a friend phoned me and said: ‘Have you seen the papers? They think you’re a spy’.”

However, Bevan became confident that he had escaped detection and was stunned when he was arrested. “I was told to go and check the managing director’s computer. I went in and there were seven or eight of them in suits and I was arrested.” He was charged the next day with two counts of conspiracy under the Criminal Law Act 1997. He was later charged with three offences under the Computer Misuse Act 1990.

Pryce had been charged in June 1995, about 13 months after his arrest, with 12 offences under Section 1 of the Computer Misuse Act 1990. He was also charged with conspiracy three days before Bevan’s arrest. At the culmination of one of the biggest ever international computer crime investigations and after a massive security scare in the United States, law enforcers were left with a meagre and faintly embarrassing prize: two young hackers who in their spare time, from the comfort of their bedrooms, had penetrated what should have been the most secure defence network in the world. To rub salt into the wounds, their credentials were hardly impressive. Pryce had scraped a D grade in computer studies at A-level and Bevan had dropped out of an HND course in computer science.

Pryce’s father, Nick, who restores musical instruments, said: “They said Richard was a No 1 security threat and I think that was just rubbish. They had overreacted and when they found out it was just a teenager, they still wanted to try to make an example of him. I never knew what he was doing at the time; I just thought he was in his bedroom playing on his computer. When I found out, I never thought he had done anything particularly wrong and neither did our friends. He just showed how bad security was on those computers.”

But how did two rather ordinary young men manage to penetrate the Pentagon computer system and spark such a massive security alert? Both were bright and articulate, but there was nothing in their backgrounds to suggest a computer wizardry that would outwit the American military. Their success was based on a mixture of persistence and good luck, which was abetted by crude security mistakes in the Pentagon computer system. Pryce had had a musical upbringing with his two sisters, Sally and Katie, and had a passion for playing the double bass. He was bought his computer when he was 15 to help him in his studies. He would spend his spare time linked up to a bulletin board on the Internet, where computer users traded information and chatted. It was here that he got his first introduction to hacking.

“I used to get software off the bulletin boards and from one of them I got a ‘bluebox’, which could recreate the various frequencies to get free phonecalls,” he said. “I would phone South America and this software would make noises which would make the operator think I had hung up. I could then make calls anywhere in the world for free.”

Now 20 and in his third year at the Royal College of Music in London, Pryce said: “I would get on to the Internet and there would be hackers’ forums where I learnt the techniques and picked up the software I needed. You also get text files explaining what you can do to different types of computer. “It was just a game, a challenge. I was amazed at how good I got at it. It escalated very quickly from being able to hack a low-profile computer like a university to being able to hack a military system. The name Datastream Cowboy just came to me in a flash of inspiration.”

The attack on Rome Laboratory, his greatest success, relied on a ferret called Carmen. Pryce easily gained low-level security access to the Rome computer using a default guest password. Once inside the system, he retrieved the password file and downloaded it on to his computer. He then set up a program to bombard the password file with 50,000 words a second. “I just left the computer running overnight until it cracked it,” he explained.

If all the air force officers with access to the computer had followed orders and used passwords with a mixture of numerals and letters, his attack would have been foiled; but luck was on his side.

Morris, who has since left Scotland Yard’s computer crime unit and now works in London for Computer Forensic Investigations, a private company, revealed: “He managed to crack the file because a lieutenant in the USAF had used the password Carmen. It was the name of his pet ferret. Once Pryce had got that, he was free to roam the system. There was information there that was deemed classified and highly confidential and he was able to see it.”

Once he was in the system, Pryce kept getting access to higher levels in his aim to become a “root user”, which gives the hacker total control of the computer with the power to shut out other users and command the entire system.

“I was interested in Rome Labs because I knew they developed stuff for the military. I just wanted to find out what they were doing. I read that UFO material was being kept at Wright Patterson base and I thought it would also be a laugh to get in there. I also hacked into a Nasa site,” he said. “Rome Labs was my main project. I got the programming code for an artificial intelligence project. I downloaded files so I could view them at leisure at home.

“I know there was a big fuss when I tried to hack into a computer in Korea, but there was nothing sinister about it. I just fancied having a go at a different sort of computer and I happened to be on the Rome Laboratory computer. I just tapped in the address for the Korean research computer, but I didn’t hack into it. It never went further than that.” During an intensive three months of hacking, Pryce sent e- mails at least twice a week to the fellow hacker he knew as Kuji, without knowing his real name was Mathew Bevan.

Bevan, who is now 23, was more of a loner than Pryce and would spend up to 30 hours without a break on his computer. He claims the fraternity of hackers gave him the friendship that he had failed to find during his childhood. “I was bullied at school and I found my little community and interaction through my computer,” he said. “The hackers would all egg each other on. There wasn’t anything malicious about it. If there was, I could have downed as many computer systems as I wanted. I was just really looking for anything about UFOs. It was like war games; I just couldn’t believe what we could get into. I wasn’t tutoring Pryce, but the Americans made out I was because they thought I was some kind of east European masterspy.” Pryce agrees: “We embarrassed them by showing how lax their security was and that’s why they made out we had been a huge security threat. I’m now amazed by what I did, but I wasn’t surprised at the time. It was just my hobby. Some people watched television for six hours a day, I hacked computers.”

The first time Pryce and Bevan met in person was in July 1996 when they appeared at Bow Street magistrates court jointly charged with conspiracy and offences under the Computer Misuse Act. “He was at the back of the court when I went in and his mother said: ‘You’d better say hello’, which he did. We didn’t even have a chat,” said Bevan.

Conspiracy charges against both Pryce and Bevan were later dropped, but in March last year Pryce was fined ?1,200 after admitting 12 offences under the Computer Misuse Act. His lawyers said in mitigation that there had been some exaggeration when the Senate armed services committee had been told in 1996 that the Datastream Cowboy had caused more harm than the KGB and was the “No 1 threat to US security”. The remaining charges against Bevan were dropped in November after the Crown Prosecution Service decided it was not in the public interest to pursue the case.

Nevertheless, the case of Datastream Cowboy and Kuji remains one of the most notorious in American cyber history. The two young men are living this down in different ways. Pryce’s computer was confiscated, to his initial dismay. “After I had my computer taken away it was quite difficult because I had been doing it every night for a year,” he said. “If they hadn’t caught me, I would have carried on.” Now he thinks hacking was a waste of time and insists he will never do it again. He does not even own a computer any more.

Bevan, however, has put his notoriety to good use: he is now employed testing the computer security of private companies.Targeting the Pentagon United States defence computers have for years been one of the most covetedtargets for hacking addicts inspired by the film War Games, which showed a boy cracking an American defence network and nearly starting the third world war.

One of the pioneers of this craze was Kevin Mitnick, who repeatedly hacked into Pentagon computers in the mid-1980s. He was jailed in 1989 but continued his exploits on his release and was arrested again after a two-year hunt by the FBI. The number of cyber attacks on the Pentagon is estimated by Washington officials as 250,000 annually, but the incidents the public hears about are only the few where hackers get caught. In 1996 six Danes who hacked into Pentagon computers were given sentences of up to three months. The same year, special agents tracked down three teenage hackers in Croatia who had also succeeded in penetrating Pentagon computers.

They were never identified or charged, however, as there is no law against computer hacking in Croatia. Last month there was a spectacular example of the hackers’ work when American defence officials revealed that the Pentagon computer network had been subjected to a relentless two-month attack. CIA agents were reportedly anxious that the hackers might be the agents of Saddam Hussein.

FBI agents blamed a secret convention of hackers believed to be held in New York. A few days ago, the real culprit gave himself up. Ehud Tenenbaum, an Israeli teenager who dubbed himself The Analyser, had worked with two young hackers in California. Under house arrest in Tel Aviv, he said the attacks were not malicious. He had concentrated on American government sites because he hated organisations. “Chaos, I think it is a nice idea,” he said.

(c) Times Newspapers Ltd, 1998.

SUNDAY TIMES 29/03/98

Infowar.Com & Interpact, Inc. WebWarrior@Infowar.Com

Submit articles to: infowar@infowar.com
Voice: 813.393.6600 Fax: 813.393.6361

Last modified: Sun, 03 Jan 1999 00:04:46 GMT

Cyber Terrorism – American Banker
Mon, Sep 08 1997

Thanksgiving dinner last November. William Marlow is just pushing back from the family table when the phone rings. One of his clients, an unnamed Midwestern financial institution, thinks it’s under cyber- attack. For Marlow, the next few days are all long, filled with pizza.

Marlow is a svp at McLean, VA-based Science Applications International Corp. (SCI), which operates a computer security team headed by Marlow and Dr. Mark Rasch, formerly U.S. Attorney for Computer Crime at the Department of Justice. The team has 47 bank clients worldwide, including, they say, three of the nation’s largest.

When the call came, the computer security team assembled in their war room in McLean, established a secure link with their client’s network, and began systematically securing the client’s computer operations while metaphorically patrolling the walls, looking for anything from a simple mistake that might have accidentally set off the alarms, to a sophisticated timing attack, designed to distract the firewall while intruders slip into the system. “What the client was afraid of was that a Trojan horse had been introduced,” says Marlow. A Trojan horse is a program that enters the computer network disguised as a harmless message, then opens a so- called “back door” for the attackers. “While we were doing that, we received a message from two individuals that was an extortion demandowe’re talking significant dollars, enough to alter our fee structure,” says Marlow.

The Federal Bureau of Investigation (FBI) was brought in by the client, and the two teams, working together, tracked down the perpetrators. Marlow and his team built a chain of custody of evidence for the prosecution under Rasch’s supervision, while the FBI pounded the pavement, locating and arresting the criminals, who are reportedly awaiting trial.

At press time, the FBI said it needed more specific information before it could comment on Marlow’s experience.

Marlow’s client got off easy. Last year, The Times of London a publication not known for its sensational has reported that several London financial institutions had paid up to $400 million to fend off extortionists who used logic bombs (software programs that cause systematic errors) to demonstrate their ability to destroy those institution’s global operations. At least one of the attacks sent the proceeds to Russia, according to The Times story, which ran on the front page of its June 2, 1996 edition. Other journalists have confirmed the report, although officials steadfastly deny it. Both these incidents were probably more a matter of cyber- gangsterism than anything elseojust a new way to hold up banks. But in today’s strange new world, they could as easily have been perpetrated for kicks by a kid in Cedar Rapids, for money by a former programmer from the Soviet Ministry of Defense working for the Russian Mafiya, or, more dangerously, by a politically motivated terrorist trained by the CIA in Afghanistan, working in the Sudan with financing from a Saudi billionaire and intending to harm America by attacking its lifeblood.

Every Country for Itself?

And therein lies the rub: Once a bank is under cyber attack, it doesn’t much matter whether the enemy wants your money or your life; the lines between mere criminality and political action are blurred by the anonymity of the attack. And since in cyberspace national boundaries aren’t even lines on a map, computer attacks don’t always yield to tidy legalistic solutions, even if the computer that launched the attack can be traced and happens to be in a nation with laws against themoby no means a universal condition. Monaco, for instance, has no laws covering computer crime.

The result for America’s banks is a sort of medieval world in which anything can happen, law is nonexistent, and everyone needs strongholds and armed escorts when traveling from one world to the other. And because the world is filled with persons who consider America’s role as the citadel of democratic capitalism, and the exemplar of modern scientific civilization to be fundamental attacks on their way of life, a cyber attack on one bank could as easily be a first step in a plan to crash the international payments system as an attempted robbery.

And examples of cyber terrorismoor at least how vulnerable we are to themodo exist, though no official will admit to a cyber terrorist attack on a U.S. bank.

In 1994, for instance, according to 1996 Congressional testimony, two hackers named Datastream Cowboy and Kuji crashed the computer systems at Rome Air Force Base in Rome, NY, for 18 days. Rome AFB works on very sensitive defense projects; according to the testimony, not only were sensitive files stolen, but successful attacks were launched from the Rome computers to NASA’s Goddard Space Flight Center, Wright- Patterson AFB, and defense contractors around the country.

Datastream Cowboy was eventually arrested in England and convicted there of telecommunications theft. Kuji is still at large; no one knows what happened to the stolen data.

The same testimony disclosed not only that the Defense Information Systems Agency’s internal testing successfully penetrates Defense Department systems 65 percent of the time, but also that it estimates Defense systems are attacked about 250,000 times a year. It doesn’t take much to see that if a Defense Department computer system can be penetrated, so can a bank’s.

This is no secret to Admiral J. Mike McConnell, a Booz, Allen & Hamilton partner who recently retired as director of the once super- secret National Security Agency. “Banks talk about their systems as though (they have) no external connections,” he says. “What most people don’t appreciate today is that most banks today, when they are communicating, are traveling on the public switch networkothe phone system structure. When people say they’re using the Internet, all they really mean is that they’re riding around on the public switch network. That induces a certain amount of vulnerability.”

Downloading Attack Tools

Banks will tell you they have “leased lines” between their branches, he says. “But they don’t really have a physical lineothey have a restoral priority; it means they’ll get service, but they don’t know whether it’ll go through New Orleans or Chicago. So the point is, that opens you to potential vulnerabilities.

“Now you can encrypt that message, and it will be more difficult to interfere with anything; and a bank can have certain kinds of defensesofirewalls and whatnotobut once you understand and appreciate them, there are ways to attack them. Nothing is 100 percent guaranteed impenetrable. In my experience, when you are testing something to see if there is a vulnerability, you most always find a vulnerability.”

Added to that, says McConnell, is that on the Internet, all the attack tools can be downloaded; there is a “tremendous, richly robust hacker group that shares all these techniques” used for system penetrations, while readily available Silicon Graphics workstations make very capable platforms for cyber attacks.

Today, with all our networking, the vulnerability does not end with the transmission (of data), McConnell cautions. “It’s gone from worrying about data in motion to also worrying about data at rest,” because much information is stored on hard drives. “That’s where the vulnerability is,” he says.

Luckily, bankers are a paranoid lotosafes and vaults were more or less invented for themoand banking systems are on the whole among the most secure around. This was well demonstrated during the recent “war game” simulations conducted in June and July by McConnell in his McLean, VA, offices for the President’s Commission for Critical Infrastructure Protection (PCCIP).

Global Ops Riskier

After two and a half days simulating escalating problems that began as apparently unconnected events and eventually manifested themselves as a full-scale cyber attack on the United States in which truck bombs were exploding at airports, the water supply was compromised, and attempts were made to penetrate FedWire and CHIPs, only the banking and nuclear power systems were left intactoevery other critical infrastructure had been forced to request government help. Among those with poor marks: law enforcement and intelligence, which didn’t share information.

The PCCIP was created last year by President Clinton to address the fact that most of the computer networks in this country are interrelated and vulnerable to cyber attack both by terrorists, who may or may not be state-sponsored, as well as attacks by state- sponsored groups.

This vulnerability is only magnified, say PCCIP officials, by the fact that corporate outsourcing has created concentrations of services in a few hands, disruptions of which could create significant vulnerabilities within whole industries, including financial services. And modern business models built around the Internet only worsen those problems. “You’re looking at an emerging business model in an emerging (global) economy that is very different from the old one, where you had manufacturing on the bottom floor and management on the top floor,” says Peter Daly, a PCCIP commissioner and U.S. Treasury official. “Now you’ve got a CEO in Baltimore, his manufacturing is in China, his software is written in India, his telemarketing is in Irelandothe Internet enables that, and that’s what we’re focusing on. The infrastructure is the carrier of commerce now, and there are important new kinds of risks there.”

It was stimuli like these, say officials at the General Accounting Office (GAO), that led it this year to begin testing the financial system for potential weaknesses. The testing is occurring now; first it will try to penetrate banks, and then it will try to penetrate FedWire. The effort is being conducted out of the GAO’s San Francisco office.

At the level at which the PCCIP is working, say officials, the worry is less about computer attacks on individual banks than it is about attacks on major computer centers that support the nation’s financial infrastructureothe problem being that at a certain level, the two are virtually identical and that a simple truck bomb, like those exploded at the World Trade Center or in Oklahoma City, could cause significant damage to, say, the New York Stock Exchange or Brussels-based Society for Worldwide Interbank Financial Telecommunication (S.W.I.F.T)., while taking down the telecommunications system with logic bombs would obviously affect the financial system along with the rest of the country.

How to Fight Attacks

But there are also high-tech attacks to worry about. Some attacks, like exploding a microwave or flux generator bomb outside the Richmond Federal Reserve, potentially taking down FedWire by destroying its computer system, require substantial resources and are impractical; both sorts of bombs are very large and would have to be delivered by truck, requiring the same sort of industrial base needed to build nuclear weapons. A flux generator bomb is capable of throwing an enormous magnetic field around a building, crashing all the systems within.

But there are lower tech attacks that even small banks need to worry about, since they could be used in smaller-scale extortion. A HERF, or high energy radio frequency, gun, for instance, is a small, futuristic device that sends an energy “spike” through a metal system, frying it.

These devices, which police forces are considering issuing to some of their personnel as a means of stopping escaping vehicles, are basically ray guns, right out of Buck Rogers. The technology, which is nowhere near as sophisticated as a flux generator bomb, could easily move from law enforcement to the criminal and terrorist population as it becomes more widespread. Tazers, readily available today, can also be used to attack and disrupt computer networks.

But these, at least, are not tough to defend against, according to a paper written by Carlo Kopp, an Australian computer scientist. Since a HERF or Tazer attack made against a LAN is an electrical attack in which a power spike does the damage, he says, simply replacing the copper- based LAN with fiber-optic cable provides a practical defense. More advanced measures advocated by Kopp start with isolating the computer power system from the main power supply with an old-fashioned motor- generator power isolator, and go as far as building the sort of copper- mesh “Faraday Cage,” sometimes put around a clean computer room, around an entire building.

Cost of Protection

But there’s a price to be paid for upping the security ante, says an official at Washington, D.C.-based American Bankers Association, who requested anonymity. “(A determined group) can always kidnap somebody’s family and make them do what they want, so I’m not sure how far you want to go” he says. “The thing you’ve got to remember is that these days, you’ve got guys carrying bombs with toggle switches instead of timers.” Toggle switches are manual triggering devices used by suicide bombers.

“Low probability events are things banks have to deal with when they’re catastrophic, and when they can be reasonably managed,” he continues. “The thing is, we’ve got tremendous measures in place already, and the only other things (we could do) is to do full-field investigations (of employees) so not only do we know who our guys are, but that the government knows who our guys are, so they’d be more willing to tell our guys what’s going on.”

That cooperation could become far-reaching. Because the implications of cyber attack are transnational, and the interpenetration of terrorism and plain criminality has become so complete, many are calling for international police efforts. “We’re totally behind the eight-ball, and everybody’s stymied by this brick wall called national sovereignty, which the bad guys laugh about,” says Arnaud de Borchgrave, who was Newsweek’s chief foreign correspondent for 30 years, and who now heads the Center for Strategic and International Studies, based in Washington. “Any thinking person knows that the traditional prerogatives of national sovereignty have not only been overtaken by the information revolution, but that things like logic bombs and worms are the new arsenal in a new geopolitical calculus that enables the non-states, and even individuals, to take on a superpower. That’s the sort of world we’re living in, and our leaders don’t want to face up to it.

“You need laws that enable you to operate beyond (national) borders,” he adds. “Right now, if the Pentagon is attacked, they don’t have the right to retaliate, even when they know the source of attack. We’re a long way from an international SWAT team or teams, which is what I’m thinking about.”

As things stand, meanwhile, most large banks have either contracted with companies like SAI, or maintain their own computer security teams, generally denying to the public that they face any real dangers and, it’s widely assumed, leaving their own computer security crises unreported. This is exactly the wrong way to handle it, says Senator John Kerry, of Massachusetts. Senator Kerry’s recently published book, The New War: The Web of Crime that Threatens America’s Security, highlights the increasing incidents of money laundering facilitated, in part, by computer- savvy criminals. “It goes to their overall attitude to the whole thing,” he says. “You have to put this thing out there; people have to know and understand it. The longer they’re quiet and the longer these guys can operate without a sense of public outrage and concern, the harder it’s going to be to marshal the forces to change the situation.”

Making Attacks Public

“They’ll need government help to fight these incursions from the Net,” he says. “But acting on their own can’t be adequate. You can do certain things, but if you keep this thing covert, you’ll never summon the kind of clout you need to have a legitimate cure.

“That legitimate cure will involve some kind of understanding about how you’re dealing with encryption, with how you’re dealing with secrecy, of how privacy rights and access rights are going to exist, and of course law enforcement’s rights with respect to all this,” Kerry says. “It’ll have to be a cooperative effort, and will involve some public law.”

INTERNET POSES GREATER RISK

Serious cyber attacks on banks are still not common: SAI estimates they see only about five serious attempts on banks in any year. But a 1994 study by the RAND Corporation points out that as a simple matter of statistics, the danger of attacks on institutions of all sorts, including financial institutions, is bound to grow in tandem with the spread of computer use and the growth of the Internet.

Statistics on computer incidents reported to CERT, a computer security information clearing house and research facility located at Pittsburgh’s Carnegie-Mellon University and financed by the Defense Advanced Research Projects Agency (DARPA), grew about ten-fold between 1990 and 1996. An apparent leveling off of reported incidents since 1994, says a spokesman, is more probably due to a multiplying of places to report such incidents than a slackening in hacker activity. An incident can affect one computer or, on a LAN, 1,000. CERT began life in 1988 as DARPA’s computer emergency response team.

And a 1997 study by San Francisco’s Computer Security Institute, conducted in association with the FBI, says that the 249 organizations who replied to their survey reported losses totaling $100,119,555. System penetration, fraud, sabotage, theft of proprietary information and virus attacks accounted for $65,623,700. Financial services companies, including banks, accounted for 18.77 percent of responses.

CSI officials say the average loss to financial fraud was $957,384, while losses to system penetration averaged $132,250. In comparison, losses from Internet abuse by employees totaled about $1 million.

HISTORY-INDUCED TERROR

Ironically, it was our triumph in the Cold War that set the stage for our present problems. The United States won the Cold War. But Russia was not occupied.

This historic anomaly loosened control over both the former KGB and its clients in the world of terror. The result is less actual terroroviolent attacks on civilians by trained, politically motivated peopleobut more trained people left to shift for themselves. “The collapse of the Soviet Union has obviously let loose a tremendous amount of human capital and talent that has a lot of abilities that would normally be used for legitimate business purposes or purposes of the State, but now does not have an outlet,” says Francis Fukuyama, noted author of The End of History. “A lot of that is going to come out in illegitimate activities, including things like cyber terrorism.”

And in any event, Russia today is only partly what Americans think of as a nation, says Ambassador L. Paul Bremer, managing director at New York’s Kissinger & Associates and former Roving Ambassador for Counterterrorism in the second Reagan Administration. “It’s a bit of a combination of both,” he says. “It is in a sense a country in that you’ve got 145 million people who mostly speak the same language, who have all grown up under a central rule from Moscow, who use a common currency, and who are more or less defended by a common army. But there is a lot of warlordism; you do have governors and other satraps out there who have a lot of authority. I don’t think the last chapter is written yet; it could go either way in Russia.”

(Copyright American Banker Inc. – Bond Buyer 1997)

_____via IntellX_____

Copyright 1997, American Banker. All rights reserved. Republication and redistribution of American Banker content is expressly prohibited without the prior written consent of American Banker. American Banker shall not be liable for errors or delays in the content, or for any actions taken in reliance thereon.

Infowar.Com & Interpact, Inc. WebWarrior@Infowar.Com

Submit articles to: infowar@infowar.com
Voice: 813.393.6600 Fax: 813.393.6361
Last modified: Sun, 03 Jan 1999 00:05:20 GMT

23 Mar 97 SOUTH CHINA MORNING POST: HACKER OF THE WEEK
:The teenage security threat: Asia Intelligence Wire

RICHARD PRYCE

If you had to imagine the number one threat to America’s security, you might go for a terrorist group or a coalition of Iraq, Libya and North Korea. You would be unlikely to select a teenage double bass player at a British music college.

But RICHARD PRYCE, from a north London suburb, can count himself among those who have been elevated to the ranks of major threats to United States national security up there alongside Iraqi leader Saddam Hussein.

Pryce’s claim to fame, or infamy, lies in the way he hacked into America’s deepest defence secrets. At one point, he was even accused of having caused more harm to the US defence and missile systems than Russian intelligence. One might, equally, imagine that such a number one threat would operate from a secret base filled with the latest computers and advanced software. But PRYCE did it all from his bedroom in the suburb of Colindale, with equipment worth a grand total of GBP7SO (HK$9,315).

He was just 16 at the time. PRYCE, who only got a D grade in computer science, obtained the passwords to download super-secret computer records in New York and California, including an Air Force base which deals with sensitive subjects such as artificial intelligence.

When he was brought to trial last week, his solicitor said that officials believed he was being manipulated by an East European outfit.
A US congressional report on computer attacks said he had been seizing control of defence department computers on the direction of an unknown third In the Senate in Washington, PRYCE was accused of “causing more harm than the KGB” and described as the number one threat to US security.
The magistrates took a more lenient view. Fining PRYCE GBP1,200 on Friday, they accepted his innocent motives after he admitted 12 charges of gaining access to the computers.

But they did order his computer equipment to be confiscated.
PRYCE, now 19, was arrested after the US Air Force Office of Special Intelligence investigated the hacking.
They codenamed the unknown culprit “Datastream Cowboy”, and finally got his name from other computer users.

The Pentagon said yesterday it was taking measures to stop its systems coming under computer attack.

22 Mar 97 British teenager fined after hacking into US defence system:
His lawyer says RICHARD PRYCE used information he learned on the Internet to gain access.

By JASON BENNETTO LONDON

LONDON – A British teenager who barely passed computer science was fined Friday for hacking into United States defence and missile systems and removing files on artificial intelligence and battle management.

RICHARD PRYCE was only 16 when he used a basic dollars 1,650 computer from his bedroom in north London to infiltrate some of America’s top security establishments.

Codenamed Datastream Cowboy, PRYCE, now 18, was the subject of allegations in the US Senate, where the unknown ‘spy’ was accused of ‘causing more harm than the KGB.’

He has also been described as ‘the number one threat to US security.’ But his lawyer insisted Friday it was a ‘schoolboy prank’ and that the teenager with just six months experience had used information taken off the Internet to break into the US networks.

Lawyers believe the case shows the extraordinary lax security deployed within US military systems.

PRYCE was fined dollars 3,200 after pleading guilty to 12 charges of gaining unauthorized access to computer systems in March and April 1994.
He has now dropped his interest in computers in favor of a double bass that he studies at the Royal College of Music in London.

The first that Pryce’s parents, Nick and Alison, knew of their son’s activities was when members of Scotland Yard’s Computer Crime Unit arrived at the home in Colindale to arrest him.
Bow Street Magistrates’ Court heard that PRYCE managed to hack into the Griffiss Air Force Base in New York.

It is alleged he downloaded material from the air force base about artificial intelligence and battlefield management systems.
He also broke into the Lockheed Space and Missile Company in California. The systems he was said to have obtained access to included those for ballistic weapons research and aircraft design, payroll, procurement, personnel records and electronic mail.

Pryce’s forays led to allegations that a spy had managed to infiltrate secret intelligence data.
His hacking was described as an example of a growing and serious threat to US national security in reports and testimony to a Senate committee by the US General Accounting Office.

Some of the more outlandish allegations about the effects of Pryce’s hacking exploits were later seen as an attempt to obtain extra funding. Indeed, US officials later insisted PRYCE had been unable to access any secret information.

Despite these claims it is understood that the British authorities were considering using a Public Immunity Certificate, a gagging order, to cover part of the hearing, but decided not to bother after the more serious charges were dropped.

Defence lawyer Geoffrey Robertson said that what the Pentagon had at first suspected was a European spy-ring was later
discovered to be the teenaged Londoner.

‘He was riding, rather than surfing, the Internet.
‘He made no profit and there was no subversion of defence systems,’ he said.
His lawyer says RICHARD PRYCE used information he learned on the Internet to gain access.

The Vancouver Sun Page A10
FINAL Copyright (C) The Vancouver Sun 1994-1997

Hackers pillaged US files to sell secrets to Saddam
By Tim Reid

HUNDREDS of military secrets, including troop movements and missile capability, were stolen from American government computers and offered to Saddam Hussein during the Gulf war, a former US security expert has admitted.

Computer hackers in the Netherlands used the Internet to steal enough top-secret information potentially to change the course of the war. Luckily for the Allies, the Iraqis ignored the data, probably fearing a hoax, according to intelligence experts.

Dr Eugene Schultz, former head of computer security at the US Department of Energy, has disclosed for the first time how he and colleagues sat helpless as the Dutch hackers pillaged the files across 34 US military sites in the months leading up to the 1991 conflict.

His revelations, to be screened on BBC 2’s Sci Files programme tomorrow, come after the conviction on Friday of a London Teenager for gaining unauthorised access to American defence and missile secrets. Using equipment that cost £750 from local shops, Richard Pryce, 19, broke into computer files of the US Air Force and the Lockheed aerospace company. US military intelligence officials claimed he had caused “more harm than the KGB”. Pryce, of Colindale, north London, who was 16 at the time, was fined £1,200.

Dr Schultz, who was also responsible for protecting the computers of US nuclear weapons sites, told the BBC that the Americans learnt for certain in October 1990 that the information was being offered to Baghdad. Working with the FBI, he pinpointed the source of the attacks to Eindhoven.

The leakage of data was certainly alarming. The Dutch hackers learnt about the exact locations of US troops and the types of weapons they had. They gained information about the Patriot missile’s capability and the movement of American warships in the region.

“We realised that these files should not have been stored on Internet-capable machines,” Dr Schultz said. “They related to our military systems, they related to Operation Desert Shield at the time, and later Operation Desert Storm. This was a huge mistake.”

Once the Dutch hackers had gained access to a military computer site, they simply kept guessing different passwords until the system let them in. Once inside, they could pick and choose the exact information they wanted. The attacks lasted for months.

“We couldn’t do anything about it,” Dr Schultz said. “If we had shut down one machine that they had been getting into, they would have found others to launch the attacks from.”

The full story of Iraqi involvement in this episode is still classified. The CIA will neither confirm nor deny that the hackers tried to sell military secrets to Iraq.

‘Datastream Cowboy’, 19, fined £1,200 for hacking secret US computer systems
By David Graves

A TEENAGE computer hacker known on the Internet as the “Datastream Cowboy,” who US military intelligence officials claimed had caused more harm than the KGB, was fined £1,200 yesterday for gaining unauthorised access to secret US Air Force computer systems.

The US Senate armed services committee was told later that the Royal College of Music student was “the number one threat to US security”.

Geoffrey Robertson, QC, defending, told Bow Street magistrates that the Pentagon had expected to find an East European spy ring responsible for the 200 security breaches, not an A-level student with a £750 personal computer in his bedroom.

Mr Roberston said Pryce had been guilty of “a schoolboy prank” and could not be blamed for the fact that security systems in the US military files “left something to be desired”. He downloaded scores of secret files, including details of the research and development of ballistic missiles.

Pryce, of Colindale, north London, admitted 12 specimen offences under the Computer Misuse Act 1990 and was ordered to pay £250 costs.