Re: [work] Re: Major hack attack on the U.S. Senate

[opticfiber]

How is that difrent then sneakiing into a hotel room and stealing tapes?
Even if the hotel room door is unlocked any honest person would stay
out.. So while the security may have failed because of the an idiot
tech, the republican party still has to be helf responsible for the
actions of there constituents. Also, I agree this is hardly a "Hack Attack".

Bill
http://www.topsight.net


Brian C. Lane wrote:

>On Thu, 2004-01-22 at 09:25, Richard M. Smith wrote:
>
>
>>http://www.boston.com/news/nation/articles/2004/01/22/infiltration_of_files_
>>seen_as_extensive?mode=PF
>>
>>Infiltration of files seen as extensive
>>Senate panel's GOP staff pried on Democrats
>>By Charlie Savage, Globe Staff, 1/22/2004
>>
>>WASHINGTON -- Republican staff members of the US Senate Judiciary Commitee
>>infiltrated opposition computer files for a year, monitoring secret strategy
>>memos and periodically passing on copies to the media, Senate officials told
>>The Globe.
>>
>>
>>
>
>[snip]
>
>You left off the most important fact in your snip. The final paragraph
>pretty well sums it up:
>
>"A technician hired by the new judiciary chairman, Patrick Leahy,
>Democrat of Vermont, apparently made a mistake that allowed anyone to
>access newly created accounts on a Judiciary Committee server shared by
>both parties -- even though the accounts were supposed to restrict
>access only to those with the right password."
>
>I sure wouldn't call this a major hack attack. Someone goofed. Someone
>else took advantage of the goof (and according to some reports even
>reported it to the bonehead technician).
>
>One one hand you really shouldn't look at someone else's files. On the
>other hand if you're cooking up dirty tricks you darn well ought to make
>sure your memos are protected, not stored in the clear on a shared
>system.
>
>And these are the jokers who want to dictate to us how to secure the
>Internet and stop SPAM? Heh!
>
>Brian
>
>---[Office 71.6F]--[Fridge 38.4F]---[Fozzy 88.8F]--[Coaster 71.7F]---
>Linux Software Developer http://www.brianlane.com
>
>

[Jonathan A. Zdziarski]

> How is that difrent then sneakiing into a hotel room and stealing tapes?
> Even if the hotel room door is unlocked any honest person would stay
> out.. So while the security may have failed because of the an idiot
> tech, the republican party still has to be helf responsible for the
> actions of there constituents. Also, I agree this is hardly a "Hack Attack".

Hotel doors are even smart enough to lock after you enter the room,
which means in this case the democrats were dumber than a doorknob.

[Jonathan A. Zdziarski]

> How is that difrent then sneakiing into a hotel room and stealing tapes?
> Even if the hotel room door is unlocked any honest person would stay
> out.. So while the security may have failed because of the an idiot
> tech, the republican party still has to be helf responsible for the
> actions of there constituents. Also, I agree this is hardly a "Hack Attack".

Hotel doors are even smart enough to lock after you enter the room,
which means in this case the democrats were dumber than a doorknob.

[ed@the7thbeer.com]

> which begs the question, unless it was explicitly labelled as such, how
> would the accessor know that he was committing unauthorized access ?

Notice is not required to constitute an offense generally under the
criminal laws (there are exceptions elsewhere, but this is not one of
them) of the United States. For example, trespass does not require you
show posting of "No Trespassing" signs. Courts will generally hold one to
a reasonable person standard and consider the actus reus and
the mens rea of the defendant. In other words, a judicial shaking of the
finger coupled with a "you should know better" is sufficient. You do not
need to have a banner saying "Authorized users only" to "criminalize" the
act. Similarly, lack of a banner does not "decriminalize" the act.

> this is quite similar to sites say, accidentally exporting windows or nfs
> shares out to the internet. a query of the server will return a mount
> request legitimate.

Nothing of the sort. You may have other liability for accidentally
exporting an NFS or CIFS share to the net, but you do not negate criminal
liability for invasion of that share. Yes, there are some exceptions
about areas of the public domain, but IIRC accidental sharing does not
constitute public domain.

-ed

[ed@the7thbeer.com]

> which begs the question, unless it was explicitly labelled as such, how
> would the accessor know that he was committing unauthorized access ?

Notice is not required to constitute an offense generally under the
criminal laws (there are exceptions elsewhere, but this is not one of
them) of the United States. For example, trespass does not require you
show posting of "No Trespassing" signs. Courts will generally hold one to
a reasonable person standard and consider the actus reus and
the mens rea of the defendant. In other words, a judicial shaking of the
finger coupled with a "you should know better" is sufficient. You do not
need to have a banner saying "Authorized users only" to "criminalize" the
act. Similarly, lack of a banner does not "decriminalize" the act.

> this is quite similar to sites say, accidentally exporting windows or nfs
> shares out to the internet. a query of the server will return a mount
> request legitimate.

Nothing of the sort. You may have other liability for accidentally
exporting an NFS or CIFS share to the net, but you do not negate criminal
liability for invasion of that share. Yes, there are some exceptions
about areas of the public domain, but IIRC accidental sharing does not
constitute public domain.

-ed

[bugtraq@anastrophe.com]

At 01:45 PM 1/23/2004, B. Kinney wrote:
>I don't disagree with your opinion on the article - it was meant to be
>shock journalism. It's the only way they can get us to read anything
>about our political system.
>
>I still am of the nature that you don't go places you don't belong. If
>you need a more concrete example, think about the ladie's room. How old
>were you when you learned which door is NOT yours?
>
>Do you ever enter the wrong one with the intent of seeing something?!
>If you did, don't you think your friends and coworkers would find it
>inappropriate and disgraceful?

that wasn't the point of the followup. the point of the followup was that
the original poster elided critical information in order to slant the
message of the article to his particular political bias.

which is just as lame and dishonest as what the republicans did.


Paul Theodoropoulos
http://www.anastrophe.com

[bugtraq@anastrophe.com]

At 01:45 PM 1/23/2004, B. Kinney wrote:
>I don't disagree with your opinion on the article - it was meant to be
>shock journalism. It's the only way they can get us to read anything
>about our political system.
>
>I still am of the nature that you don't go places you don't belong. If
>you need a more concrete example, think about the ladie's room. How old
>were you when you learned which door is NOT yours?
>
>Do you ever enter the wrong one with the intent of seeing something?!
>If you did, don't you think your friends and coworkers would find it
>inappropriate and disgraceful?

that wasn't the point of the followup. the point of the followup was that
the original poster elided critical information in order to slant the
message of the article to his particular political bias.

which is just as lame and dishonest as what the republicans did.


Paul Theodoropoulos
http://www.anastrophe.com

[Crispin Cowan]

Kirk Spencer wrote:

>Agreed this was not a "hack attack" as usually considered. However, I would
>raise two points. The first is simple - If someone starts reading files on a
>computer to which they are not supposed to have access, do we not consider
>this an attack? Even if the reason they got in is configuration errors?
>
That would depend on the configuration error. In particular, if your
"configuration error" was to publish a page to a web server where you
didn't want people to read it, and the "attack" was just surfing URLs,
or even manually editing the URLs, then I think you'd have a hard time
making the case for "intrusion". In particular, you effectively offered
the page for public viewing, so it breaks the notion of "not supposed to
have access".

The problem is that the barrier of what an anonymous visitor is
"supposed" to have access to is fuzzy. Then again, if it was not fuzzy,
it would be relatively easy to secure, too.

Caveat: IANAL, so my opinion that the courts will decide this fuzzy
issue in favor of whoever has the most money holds to weight :)

Crispin

--
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
CTO, Immunix http://immunix.com
Immunix 7.3 http://www.immunix.com/shop/

[Crispin Cowan]

Kirk Spencer wrote:

>Agreed this was not a "hack attack" as usually considered. However, I would
>raise two points. The first is simple - If someone starts reading files on a
>computer to which they are not supposed to have access, do we not consider
>this an attack? Even if the reason they got in is configuration errors?
>
That would depend on the configuration error. In particular, if your
"configuration error" was to publish a page to a web server where you
didn't want people to read it, and the "attack" was just surfing URLs,
or even manually editing the URLs, then I think you'd have a hard time
making the case for "intrusion". In particular, you effectively offered
the page for public viewing, so it breaks the notion of "not supposed to
have access".

The problem is that the barrier of what an anonymous visitor is
"supposed" to have access to is fuzzy. Then again, if it was not fuzzy,
it would be relatively easy to secure, too.

Caveat: IANAL, so my opinion that the courts will decide this fuzzy
issue in favor of whoever has the most money holds to weight :)

Crispin

--
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
CTO, Immunix http://immunix.com
Immunix 7.3 http://www.immunix.com/shop/

[Mariusz Woloszyn]

On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:

> > Which means the Democrats screwed up setting up their own share point and
> > allowed public access to it. There was no "computer glitch" which was
> > "exploited". This was completely a human screw-up. And there was no
> > hacking ("exploitation of a computer glitch") done by the Republicans.
> > Unless you wish to call clicking on a share point configured with public
> > access and opening it up "hacking".
>
> AFAIK, "hacking" is legally defined in the USA as being unauthorized
> access to computer resources. It doesn't matter if the resource was
> adequately protected (or protected at all) in first place or not. If you
> were not given permission to make use of that resource, you are
> criminally liable.
>
Do you have an explicit permission to read the content of a www.cnn.com?
What is the difference between opening a web URL and a network share?

--
Mariusz Wo³oszyn
Internet Security Specialist, GTS - Internet Partners