Accused Pentagon hacker prosecution could backfire

Posted by Kuji on June 26th, 2008

Analysis Accused Pentagon hacker Gary McKinnon is continuing to fight against extradition to the US after losing an appeal last week.

Only the Law Lords now stand between the Scot and a US trial for allegedly breaking into and damaging 97 US government computers between 2001 and 2002 and causing $700,000 worth of damage, in what US authorities have described as the “biggest military” computer hack ever. He allegedly infiltrated networks run by the US Army, US Navy, US Air Force, Department of Defense and NASA. US authorities described McKinnon as an uber-hacker who posed a threat to national security in the aftermath of the 9/11 attack.

McKinnon (AKA Solo) admits he infiltrated computer systems without permission. The 41-year-old former sysadmin said he gained access to military networks – using a Perl script to search for default passwords – but describes himself as a bumbling amateur motivated by curiosity about evidence of UFOs. He said numerous other hackers had access to the resources he was using and questions why the US authorities have singled him out for extradition.

Any damage he did was purely accidental, McKinnon claims. If convicted, following extradition and a US trial, McKinnon faces a jail term of up to 45 years’ imprisonment.

According to a reformed computer hacker accused of similar crimes 10 years ago, McKinnon is been made a scapegoat for the shortcomings of US military security.

Mathew Bevan, whose hacker handle is Kuji, was accused of breaking into US military computer systems but his 1997 case at Woolwich Crown Court was dropped after a legal battle lasting around 18 months. No attempt was made to extradite Bevan. After the case, Bevan became an ethical hacker and security consultant, first with Tiger Computer Security, and later on a freelance basis with his firm the Kuji Media Corporation.

“Both Gary and I were accused of similar offences. The difference is his alleged crimes were committed in a different political climate, post 9-11. The decision to push extradition in Gary’s case is political,” Bevan told El Reg.

Bevan, like McKinnon, has an interest in free energy and evidence of UFOs. The similarities in the case go further. The crimes Bevan is alleged to have committed were cited as evidence of cyberterrorism in US senate hearings in 1996. “They haven’t found a cyberterrorist or ‘bad boy’ for a while and it looks like they are trying to make an example in Gary’s case,” he said.

McKinnon should have been allowed to plead guilty in his own country and not be faced with the prospect of a long prison term in a US prison with “inhumane” conditions, Bevan argues.

He says the military systems McKinnon is accused of hacking remain vulnerable to attack. “I’m sure there are a lot of people on these machines, some of who the US authorities allow to get in.”

“The prosecution against Gary is about saving face for security lapses by the US military that remain as bad as they were 10 years ago,” Bevan said. “If this had happened with a corporation someone would have been sacked.”

He added that US authorities are keen to talk up the cyberterrorism threat in order to protect information security budgets.

McKinnon, unlike a US citizen who faced similar charges, is in a particularly bad situation. “The authorities are trying to rip him away from his family and ruin his life. Gary committed his alleged offences in the UK, and according to the Computer Misuse Act, jurisdiction lies here.

“Gary has suffered trial by media over the last five years, with everything weighed against him,” Bevan added.

Despite everything that’s happened to McKinnon, he reckons the case will fail to act as much of a deterrent to other would-be hackers. “Has it scared anyone? I shouldn’t think so,” Bevan said.
Final appeal

Lawyers for McKinnon are petitioning for leave to appeal to the House of Lords on grounds including the use of “deliberately coercive plea bargaining” tactics by US authorities during the course of the long running case. His lawyers argued that he had been subjected to “improper threats” that he would receive a much harsher sentence and be denied the opportunity to serve out the back-end of his jail term in the UK unless he played ball.

Appeal court judges Lord Justice Maurice Kay and Mr Justice Goldring criticised US prosecution tactics but said these didn’t offer enough grounds for appeal against the Home Secretary’s decision to confirm a 2006 ruling that McKinnon ought to be extradited to the US.

The unemployed sysadmin has had these charges over his head since March 2002 when he was arrested by officers from the UK’s National High Tech Crime Unit. The case against him lay dormant until July 2005 when extradition proceedings commenced. McKinnon has suffered ill health over recent months as a result of the stress caused by the case, according to his lawyers.

McKinnon’s supporters argue the case has wider political implications. “It is not just about Gary McKinnon, there are lots of other people, from computer hackers to legitimate businessmen, who will continue to fall foul of this sort of surrender of British sovereignty and obeisance before the extra- territorial demands of the US legal bureaucracy,” Mark, a member of London 2600 who runs the Free Gary blog, told us. “However the same lack of a requirement to show prima facie evidence also applies to European Union countries under the European Arrest Warrant,” he adds.

McKinnon’s lawyers chose not argue about whether he might be put on trial before a military tribunal but that this may well be argued in the House of Lords if leave to appeal (which is by no means guaranteed) is granted.

“Basically the judges have said ‘we have to trust the USA Government to act in good faith’, until they show that they have broken their promises – which will by then, of course, be too late for Gary McKinnon. Unlike Babar Ahmad or even any of the British citizens who were held without trial at Guantanamo Bay, Gary is actually accused of directly ‘attacking the US military’ systems,” Mark notes.

“Even if Gary faces a civilian court in the USA, his chances of being found not guilty or of getting a lenient sentence appear to be slim, given the prosecutions recommendations as to length of sentence.”

But the whole effort to try McKinnon in the US might backfire on the US military by putting its security shortcomings under the spotlight.

“If there is an actual trial in the USA, rather than a coerced or otherwise ‘plea bargain’, there are a large number of senior US military officers and civilian IT managers and auditors who are going to have to explain the incompetence or possible corruption or perhaps treason, which went on for years and months under their command, both before and after September 11,” Mark claims.

“Even if this is suppressed in court, it might lead to Congressional Committee hearings,” he adds. ®

History repeats for former hacker

Posted by Kuji on June 26th, 2008

For most people it must be hard to understand what confessed hacker Gary McKinnon is going through as the US attempts to extradite him to face trial.

But Mathew Bevan can definitely sympathise with Mr McKinnon because, ten years ago, he was in a very similar position.

As a teenager Mr Bevan became adept at breaking in to computer networks. At first any system was fair game but he soon started concentrating on those run by US military institutions.

Like Mr McKinnon he was caught, charged and threatened with extradition for what he had done.

Net losses

The knowledge he had built up hacking business, university and government computers helped find connections to military systems that he exploited to gain access.

Reading about how Mr McKinnon got started, Mr Bevan said he was amazed that security had improved so little between the time he had been exploring US military networks and when Gary McKinnon was hacking.

The same failings let both Mr Bevan and Mr McKinnon gain access to supposedly secure systems.

“It just shows that in 10 years nothing has changed,” he said.

The only difference is that in the time between the two cases the US government has been spending heavily to beef up computer security.

“Where have the budgetary increases actually been spent?” he asked.

Like Gary McKinnon, Mr Bevan was interested in information about UFOs and spent months combing networks in search of hidden data.

Mr Bevan can easily understand why Mr McKinnon kept hacking the same systems for so long when common-sense would have told him that his luck would run out sooner or later.

“You just feel like you are invincible really,” he said, describing the feeling he got when he successfully broke in to a network.

Once a hacker has won access to sensitive networks, the urge to keep on going to find more hidden information was hard to fight, he said.

“I liken it to perhaps the feeling that a parent might get if they find their child’s diary,” he said. “They know they should not read it, they know its wrong [but] they just cannot help themselves.”

Case closed

Eventually, US computer security investigators caught up with Mr Bevan, or Kuji as he was known, and he was arrested on 21 June 1996.

The US portrayed him as a dangerous potential spy rather than the teenager from Cardiff that he actually was.

He was held in a police station for 36 hours, charged under the Computer Misuse Act, and then freed to wait 18 months until the case came to trial.

It is a pity, said Mr Bevan, that the evidence against Mr McKinnon has not been exposed to scrutiny in court.

“I was almost gunning for my case to go to trial because of the amount of witnesses we had that were contradicting each other,” said Mr Bevan.

He added that there were “numerous” inconsistencies in the 40,000 pages of evidence submitted by the US that would have been good to mention in court.

“I can imagine that it would be the same in Gary’s case,” he said.

Although there were efforts made to extradite Mr Bevan, his case came to trial in the UK in 1998 but he was acquitted as it was judged not in the public interest to pursue the case. He now runs his own computer consultancy businesss.

Should Mr McKinnon face trial in the US and be sentenced to decades in jail, Mr Bevan feels such a sentence would be too harsh for what he has confessed to doing.

“Where is the leniency for admission of guilt?” he asked. “Let this guy talk to kids about how this trial has affected his life. Let this guy talk and discuss and explain, don’t send him to a punishment likely to be worse than he would receive in this country for murder.”

Hackers target latest Windows fix!

Posted by Kuji on June 26th, 2008

Hi-tech hackers have started to produce malicious programs that target the latest bugs in Microsoft’s Windows.
A worm has been spotted online that tries to use the vulnerabilities to hijack home computers.

Any computer compromised by the worm will become part of a large network set up to send out junk mail.

At the same time Microsoft is re-issuing a recent security patch which has made the Internet Explorer browser crash on some computers.

Spam sender

On 8 August Microsoft released a bumper collection of security patches for 23 separate flaws in Windows and programs in the Office software suite.

One of the problems identified in the August update was deemed so serious that the US Department of Homeland Security (DHS) issued a warning urging users to download the patch and apply it as soon as possible. The DHS has a role in securing America’s critical infrastructure which includes the internet.

Now security companies have caught copies of a worm travelling the net that tries to infect Windows machines via this loophole.

The Mocbot worm attacks machines running Windows 2000 or XP that only have Service Pack 1 installed.

“As Microsoft only issued a patch against this vulnerability last week, many Windows computers probably remain unpatched and vulnerable to these threats,” said Carole Theriault, senior security consultant at Sophos in a statement.

Computer security firms have seen two variants of this worm circulating online. Analysis by Joe Stewart at security firm Lurhq show that, once installed, it tries to download a trojan known to act as a spam proxy.

These are networks of compromised machines that junk mailers have been forced to use because so few net service firms will host companies that send out millions of unwanted messages.

Microsoft said it would be re-issuing one of the security patches because, in certain circumstances, it can cause the Internet Explorer browser to crash.

The problem occurs with the MS06-42 update which tried to fix eight separate vulnerabilities in the IE browser.

Relatively few users are thought to be suffering from the clash between IE and the security patches. Microsoft said it affected IE with Service Pack 1 installed but only if visiting websites that use data compression and the widely used version 1.1 of the HTTP web protocols.

Microsoft said it expected to have the new version of the MS06-42 update ready by 22 August. However, a “hotfix” has been made available but Microsoft said this should only be installed on those computers crashing because of the update.

‘Nasa hackers’ detained in Chile!

Posted by Kuji on June 26th, 2008

The authorities in Chile have arrested four people who the police say are members of one of the world’s most successful groups of computer hackers.
The men are accused of breaching more than 8,000 websites, including that of US space agency Nasa.

One of the men, who has used the alias “Net Toxic”, is alleged to be one of the most prolific hackers in the world.

The men were detained in simultaneous raids in three cities in Chile, including the capital Santiago.

The Chilean police carried out the operation in co-ordination with Interpol and intelligence services from the US, Israel and several Latin American nations. The arrests came after an investigation lasting eight months, Chilean officials said.

The four men also allegedly managed to infiltrate the websites of the Chilean finance ministry and University of California at Berkeley in the US.

And they are accused of gaining access to government websites from a range of other countries, including Venezuela, Turkey and Israel.

Those Russians and their laws!

Posted by Kuji on June 26th, 2008

Police in Moscow have arrested a group of hackers led by a 63-year old retired computer programmer, who they said was bitter about his small pension.

Police said the hackers worked from internet cafes in Moscow to steal numbers from credit cards belonging to clients in foreign countries.

Police said they then used the cards to make false purchases, using an online company they had created.

The hackers could face up to 10 years in prison, if convicted under Russian law.

According to police, computer fraud in the Russian capital costs businesses at least $12m a month.

Copyleft © 2007 - 2012+ Kuji Media Corporation Ltd.. All rights reserved.