-Caveat Lector- Mar 29th 2001 >From The Economist print edition http://www.economist.com/science/displayStory.cfm?Story_ID=550004 IN AUGUST 1986, an astronomer at the University of California, Berkeley, noticed a 75-cent discrepancy in the accounts for a computer in his laboratory. This was an intriguing problem for Clifford Stoll. When he investigated, he found that somebody had broken into his computer and used it for a short time without permission-just enough to unbalance the accounts. In what has since become the first, legendary, tale of computer forensics, Dr Stoll spent a year of meticulous work tracking and recording the hacker's movements. He watched him use the Berkeley computer to attack military computers in Alabama, California and inside the Pentagon. It turned out that the intruder, a German hacker called Markus Hess, was selling American military secrets to the Russians. Mr Hess was caught thanks largely to Dr Stoll's diligent pursuit of him. Fifteen years later, computer forensics is a growing commercial and legal activity. It even has its own academic literature. Computer forensics refers to the set of tools and techniques that is needed to find, preserve and analyse fragile digital evidence, which is susceptible to alteration and erasure at many levels. Its practitioners gather these data, and create a so-called "audit trail" for criminal prosecutions. They search for information which may be encrypted or hidden in graphics files, unallocated disk-space and even random memory dumps known as file slack. Most cunningly of all, they set up "honeypot" computers that lure malicious hackers (as the branch of the hacking fraternity that aims to damage the machines it gains access to is known) into giving themselves, and their techniques, away. The most ambitious public example of this is the Honeynet Project, a network of honeypot computers that was set up a couple of years ago by Lance Spitzer of Sun Microsystems. Last week, the Honeynet Project reached the conclusion of its "Forensic Challenge", a sort of digital version of the game "Cluedo" ("Clue", to Americans), which attempts to discover that, for example, "Miss Hackwell" did it to the Linux with the Ramen worm. The challenge showed that analysing traces of an attack by malicious hackers is not as easy as it sounds. David Dittrich, the co-ordinator of the Forensic Challenge (and a security engineer at the University of Washington, in Seattle), offered contestants a snapshot of one of Honeynet's hacked systems. The challenge for the teams was to see who could find out most about what had happened. Each of the 13 submissions took a slightly different approach, and nearly every entrant found at least one thing that the others had not. But, even though many entrants had more than six years' experience in security or systems administration, only three teams identified the information that showed who was probably behind the attack. The Honeynet Project is run by a group of 30 computer-security engineers, some of whom, says Mr Dittrich, have "slightly chequered" pasts. But it has proved its worth. Last year, for example, it successfully tracked down a group of malicious Pakistani hackers who were trying to use the network to attack websites across India. That attempt highlights one common reason that malicious hackers attack computers. They are looking for a way of launching a veiled attack on a third party. But what the project also found is that most attempts to do this are not, actually, very sophisticated. There are legions of low-tech "script-kiddies" who are using automated software tools to find and take over any vulnerable computers on the Internet. Well-known and easily available programs, such as NetBus, Back Orifice and Sub 7, allow a malicious hacker to gain full control of that machine's operating system. Last year, script-kiddies used a similar technique to launch so-called distributed denial-of-service attacks on the websites of Amazon, eBay, Yahoo! and CNN, bombarding them with junk until the volume of traffic paralysed them. Hack to the future This sort of attack is likely to become more frequent. The Internet is, in any case, set up in a way that makes it difficult for computers to distinguish friend from foe. And the spread of "always on" connections such as cable modems and digital subscriber lines mean that lots of computers with poor security are permanently linked to it. As computers get cheaper, many owners have come to view them as little more than appliances like televisions, and are unconcerned about protecting them from hackers. Because of this, sophisticated break-in techniques are no longer necessary. Security experts therefore reckon that the automated tools used by script-kiddies are an important threat. One such tool, the Ramen worm, attacks computers that run a particular version of the Linux operating system. Everything needed for an attack is bundled together in this program. It can scan computers for vulnerabilities in their security systems, break through any gap it finds, install itself on its new host, and propagate itself to other machines. Ramen itself is not that serious a problem, as it is easy to detect and shut down. But more sophisticated programs, such as Lion, are now causing serious trouble, and worse could be to come. The only bright spot on the horizon is the development of automated investigation tools to counter the automatic hacking tools. An early example of this is the Coroners Toolkit (TCT), which speeds up and standardises the process of making a digital-forensic examination. TCT makes copies of configuration files (which show how the computer it is checking is set up), log files (which record what the computer has been up to), process-information files (which indicate how the computer has actually done the things it has been up to), network-state files (the conversations that the computer has been having with other computers), and other critical data necessary to make the evaluation. It also makes it easier to find the files that have been created, accessed and modified during an attack, and it is able to reconstruct deleted files from raw data found in various hidden parts of a computer's hard disk, such as unallocated space and file slack. Despite these burgeoning countermeasures there is, of course, no such thing as perfect security. So is it worth setting traps, hiring consultants and patching holes, if there is nothing on your system worth stealing or that is costly to repair? It might be, for there is also the thorny issue of liability. The courts have yet to decide who is liable if a computer system with lax security is used to launch a denial-of-service attack, but a number of lawsuits are pending. As far as the criminal law is concerned, computer forensics has come a long way. But the field is still far from the position in which malicious hackers are, like ordinary criminals, caught and prosecuted often enough to provide some sort of deterrent. Which is a pity, for few, these days, do as little as 75 cents' worth of damage. Copyright © 1995-2001 The Economist Newspaper Group Ltd. <A HREF="http://www.ctrl.org/">www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance—not soap-boxing—please! These are sordid matters and 'conspiracy theory'—with its many half-truths, mis- directions and outright frauds—is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRLgives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://peach.ease.lsoft.com/archives/ctrl.html <A HREF="http://peach.ease.lsoft.com/archives/ctrl.html">Archives of [EMAIL PROTECTED]</A> http:[EMAIL PROTECTED]/ <A HREF="http:[EMAIL PROTECTED]/">ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
