Onderwerp: Re: [work] Re: Major hack attack on the U.S. Senate

How is that difrent then sneakiing into a hotel room and stealing tapes?
Even if the hotel room door is unlocked any honest person would stay
out.. So while the security may have failed because of the an idiot
tech, the republican party still has to be helf responsible for the
actions of there constituents. Also, I agree this is hardly a "Hack Attack".

Bill
http://www.topsight.net


Brian C. Lane wrote:

>On Thu, 2004-01-22 at 09:25, Richard M. Smith wrote:
>
>
>>http://www.boston.com/news/nation/ar...tion_of_files_
>>seen_as_extensive?mode=PF
>>
>>Infiltration of files seen as extensive
>>Senate panel's GOP staff pried on Democrats
>>By Charlie Savage, Globe Staff, 1/22/2004
>>
>>WASHINGTON -- Republican staff members of the US Senate Judiciary Commitee
>>infiltrated opposition computer files for a year, monitoring secret strategy
>>memos and periodically passing on copies to the media, Senate officials told
>>The Globe.
>>
>>
>>
>
>[snip]
>
>You left off the most important fact in your snip. The final paragraph
>pretty well sums it up:
>
>"A technician hired by the new judiciary chairman, Patrick Leahy,
>Democrat of Vermont, apparently made a mistake that allowed anyone to
>access newly created accounts on a Judiciary Committee server shared by
>both parties -- even though the accounts were supposed to restrict
>access only to those with the right password."
>
>I sure wouldn't call this a major hack attack. Someone goofed. Someone
>else took advantage of the goof (and according to some reports even
>reported it to the bonehead technician).
>
>One one hand you really shouldn't look at someone else's files. On the
>other hand if you're cooking up dirty tricks you darn well ought to make
>sure your memos are protected, not stored in the clear on a shared
>system.
>
>And these are the jokers who want to dictate to us how to secure the
>Internet and stop SPAM? Heh!
>
>Brian
>
>---[Office 71.6F]--[Fridge 38.4F]---[Fozzy 88.8F]--[Coaster 71.7F]---
>Linux Software Developer http://www.brianlane.com
>
>

I don't disagree with your opinion on the article - it was meant to be
shock journalism. It's the only way they can get us to read anything
about our political system.

I still am of the nature that you don't go places you don't belong. If
you need a more concrete example, think about the ladie's room. How old
were you when you learned which door is NOT yours? =20

Do you ever enter the wrong one with the intent of seeing something?!
If you did, don't you think your friends and coworkers would find it
inappropriate and disgraceful? =20



----Original Message-----
From: ~Kevin Davis=B3 [mailto:computerguy@cfl.rr.com]=20
Sent: Thursday, January 22, 2004 8:29 PM
To: BUGTRAQ@SECURITYFOCUS. COM
Subject: Re: Major hack attack on the U.S. Senate


This was clearly not a "hack attack". The title and opening content of
this article is quite intentionally misleading. The phrases
"infiltration", "monitoring secret memos", "exploited computer glitch",
"hack attack" are used. If you read the entire article you will find
out the following:

First, "A technician hired by the new judiciary chairman, Patrick Leahy,
Democrat of Vermont, apparently made a mistake that allowed anyone to
access newly created accounts on a Judiciary Committee server shared by
both parties -- even though the accounts were supposed to restrict
access only to those with the right password."

Which means the Democrats screwed up setting up their own share point
and allowed public access to it. There was no "computer glitch" which
was "exploited". This was completely a human screw-up. And there was
no hacking ("exploitation of a computer glitch") done by the
Republicans. Unless you wish to call clicking on a share point
configured with public access and opening it up "hacking".

Additionally the Republicans allegedly "in the summer of 2002, their
computer technician informed his Democratic counterpart of the glitch".

The Republicans knew that the share was supposed to be protected (why
else would they inform the Democrats of the misconfiguration?) so they
certainly did something wrong despite (supposedly) warning the Democrats
of the problem, but not to the extent that the article - in the way that
it was written - would like you to believe.

----- Original Message -----=20
From: "Richard M. Smith" <rms@computerbytesman.com>
To: "BUGTRAQ@SECURITYFOCUS. COM" <BUGTRAQ@securityfocus.com>
Sent: Thursday, January 22, 2004 12:25 PM
Subject: Major hack attack on the U.S. Senate


>
http://www.boston.com/news/nation/ar...ltration_of_fi
les_
> seen_as_extensive?mode=3DPF
>
> Infiltration of files seen as extensive
> Senate panel's GOP staff pried on Democrats
> By Charlie Savage, Globe Staff, 1/22/2004
>
> WASHINGTON -- Republican staff members of the US Senate Judiciary=20
> Commitee infiltrated opposition computer files for a year, monitoring=20
> secret
strategy
> memos and periodically passing on copies to the media, Senate=20
> officials
told
> The Globe.
>
> From the spring of 2002 until at least April 2003, members of the GOP=20
> committee staff exploited a computer glitch that allowed them to=20
> access restricted Democratic communications without a password.=20
> Trolling through hundreds of memos, they were able to read talking=20
> points and accounts of private meetings discussing which judicial=20
> nominees Democrats would
fight --
> and with what tactics.
>
> The office of Senate Sergeant-at-Arms William Pickle has already=20
> launched
an
> investigation into how excerpts from 15 Democratic memos showed up in=20
> the pages of the conservative-leaning newspapers and were posted to a=20
> website last November.
>
> With the help of forensic computer experts from General Dynamics and=20
> the
US
> Secret Service, his office has interviewed about 120 people to date=20
> and seized more than half a dozen computers -- including four=20
> Judiciary
servers,
> one server from the office of Senate majority leader Bill Frist of=20
> Tennessee, and several desktop hard drives.
>
> ...
>
>
>

I don't disagree with your opinion on the article - it was meant to be
shock journalism. It's the only way they can get us to read anything
about our political system.

I still am of the nature that you don't go places you don't belong. If
you need a more concrete example, think about the ladie's room. How old
were you when you learned which door is NOT yours? =20

Do you ever enter the wrong one with the intent of seeing something?!
If you did, don't you think your friends and coworkers would find it
inappropriate and disgraceful? =20



----Original Message-----
From: ~Kevin Davis=B3 [mailto:computerguy@cfl.rr.com]=20
Sent: Thursday, January 22, 2004 8:29 PM
To: BUGTRAQ@SECURITYFOCUS. COM
Subject: Re: Major hack attack on the U.S. Senate


This was clearly not a "hack attack". The title and opening content of
this article is quite intentionally misleading. The phrases
"infiltration", "monitoring secret memos", "exploited computer glitch",
"hack attack" are used. If you read the entire article you will find
out the following:

First, "A technician hired by the new judiciary chairman, Patrick Leahy,
Democrat of Vermont, apparently made a mistake that allowed anyone to
access newly created accounts on a Judiciary Committee server shared by
both parties -- even though the accounts were supposed to restrict
access only to those with the right password."

Which means the Democrats screwed up setting up their own share point
and allowed public access to it. There was no "computer glitch" which
was "exploited". This was completely a human screw-up. And there was
no hacking ("exploitation of a computer glitch") done by the
Republicans. Unless you wish to call clicking on a share point
configured with public access and opening it up "hacking".

Additionally the Republicans allegedly "in the summer of 2002, their
computer technician informed his Democratic counterpart of the glitch".

The Republicans knew that the share was supposed to be protected (why
else would they inform the Democrats of the misconfiguration?) so they
certainly did something wrong despite (supposedly) warning the Democrats
of the problem, but not to the extent that the article - in the way that
it was written - would like you to believe.

----- Original Message -----=20
From: "Richard M. Smith" <rms@computerbytesman.com>
To: "BUGTRAQ@SECURITYFOCUS. COM" <BUGTRAQ@securityfocus.com>
Sent: Thursday, January 22, 2004 12:25 PM
Subject: Major hack attack on the U.S. Senate


>
http://www.boston.com/news/nation/ar...ltration_of_fi
les_
> seen_as_extensive?mode=3DPF
>
> Infiltration of files seen as extensive
> Senate panel's GOP staff pried on Democrats
> By Charlie Savage, Globe Staff, 1/22/2004
>
> WASHINGTON -- Republican staff members of the US Senate Judiciary=20
> Commitee infiltrated opposition computer files for a year, monitoring=20
> secret
strategy
> memos and periodically passing on copies to the media, Senate=20
> officials
told
> The Globe.
>
> From the spring of 2002 until at least April 2003, members of the GOP=20
> committee staff exploited a computer glitch that allowed them to=20
> access restricted Democratic communications without a password.=20
> Trolling through hundreds of memos, they were able to read talking=20
> points and accounts of private meetings discussing which judicial=20
> nominees Democrats would
fight --
> and with what tactics.
>
> The office of Senate Sergeant-at-Arms William Pickle has already=20
> launched
an
> investigation into how excerpts from 15 Democratic memos showed up in=20
> the pages of the conservative-leaning newspapers and were posted to a=20
> website last November.
>
> With the help of forensic computer experts from General Dynamics and=20
> the
US
> Secret Service, his office has interviewed about 120 people to date=20
> and seized more than half a dozen computers -- including four=20
> Judiciary
servers,
> one server from the office of Senate majority leader Bill Frist of=20
> Tennessee, and several desktop hard drives.
>
> ...
>
>
>

Agreed this was not a "hack attack" as usually considered. However, I woul=
d=20
raise two points. The first is simple - If someone starts reading files on=
a=20
computer to which they are not supposed to have access, do we not consider=
=20
this an attack? Even if the reason they got in is configuration errors?

Second, there is a question of which side's position is easier to believe. =
=20
You said: " Additionally the Republicans allegedly 'in the summer of 2002,=
=20
their computer technician informed his Democratic counterpart of the glitch=
=2E' =20
You cut off the next sentence which says: " Other staffers, however, denie=
d=20
that the Democrats were told anything about it before November 2003." The=
=20
article does not state whether it was Democrat or Republican staffers. =20

I'll ask a simple question which indicates why I think the latter is more=20
probable: Can you think of a sysadmin who wouldn't act when told that _all=
_=20
his clients' passwords were invalid because the permissions were misapplied?

I think that the word "hack" is wrong. Otherwise, yes, I think the tenor o=
f=20
the article has validity.

Kirk Spencer

On Thursday 22 January 2004 10:29 pm, ~Kevin Davis=B3 wrote:
> This was clearly not a "hack attack". The title and opening content of
> this article is quite intentionally misleading. The phrases
> "infiltration", "monitoring secret memos", "exploited computer glitch",
> "hack attack" are used. If you read the entire article you will find out
> the following:
>
> First, "A technician hired by the new judiciary chairman, Patrick Leahy,
> Democrat of Vermont, apparently made a mistake that allowed anyone to
> access newly created accounts on a Judiciary Committee server shared by
> both parties -- even though the accounts were supposed to restrict access
> only to those with the right password."
>
> Which means the Democrats screwed up setting up their own share point and
> allowed public access to it. There was no "computer glitch" which was
> "exploited". This was completely a human screw-up. And there was no
> hacking ("exploitation of a computer glitch") done by the Republicans.
> Unless you wish to call clicking on a share point configured with public
> access and opening it up "hacking".
>
> Additionally the Republicans allegedly "in the summer of 2002, their
> computer technician informed his Democratic counterpart of the glitch".
>
> The Republicans knew that the share was supposed to be protected (why else
> would they inform the Democrats of the misconfiguration?) so they certain=
ly
> did something wrong despite (supposedly) warning the Democrats of the
> problem, but not to the extent that the article - in the way that it was
> written - would like you to believe.
(snip)

Agreed this was not a "hack attack" as usually considered. However, I woul=
d=20
raise two points. The first is simple - If someone starts reading files on=
a=20
computer to which they are not supposed to have access, do we not consider=
=20
this an attack? Even if the reason they got in is configuration errors?

Second, there is a question of which side's position is easier to believe. =
=20
You said: " Additionally the Republicans allegedly 'in the summer of 2002,=
=20
their computer technician informed his Democratic counterpart of the glitch=
=2E' =20
You cut off the next sentence which says: " Other staffers, however, denie=
d=20
that the Democrats were told anything about it before November 2003." The=
=20
article does not state whether it was Democrat or Republican staffers. =20

I'll ask a simple question which indicates why I think the latter is more=20
probable: Can you think of a sysadmin who wouldn't act when told that _all=
_=20
his clients' passwords were invalid because the permissions were misapplied?

I think that the word "hack" is wrong. Otherwise, yes, I think the tenor o=
f=20
the article has validity.

Kirk Spencer

On Thursday 22 January 2004 10:29 pm, ~Kevin Davis=B3 wrote:
> This was clearly not a "hack attack". The title and opening content of
> this article is quite intentionally misleading. The phrases
> "infiltration", "monitoring secret memos", "exploited computer glitch",
> "hack attack" are used. If you read the entire article you will find out
> the following:
>
> First, "A technician hired by the new judiciary chairman, Patrick Leahy,
> Democrat of Vermont, apparently made a mistake that allowed anyone to
> access newly created accounts on a Judiciary Committee server shared by
> both parties -- even though the accounts were supposed to restrict access
> only to those with the right password."
>
> Which means the Democrats screwed up setting up their own share point and
> allowed public access to it. There was no "computer glitch" which was
> "exploited". This was completely a human screw-up. And there was no
> hacking ("exploitation of a computer glitch") done by the Republicans.
> Unless you wish to call clicking on a share point configured with public
> access and opening it up "hacking".
>
> Additionally the Republicans allegedly "in the summer of 2002, their
> computer technician informed his Democratic counterpart of the glitch".
>
> The Republicans knew that the share was supposed to be protected (why else
> would they inform the Democrats of the misconfiguration?) so they certain=
ly
> did something wrong despite (supposedly) warning the Democrats of the
> problem, but not to the extent that the article - in the way that it was
> written - would like you to believe.
(snip)

On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:

> AFAIK, "hacking" is legally defined in the USA as being unauthorized
> access to computer resources. It doesn't matter if the resource was
> adequately protected (or protected at all) in first place or not. If you
> were not given permission to make use of that resource, you are
> criminally liable.

which begs the question, unless it was explicitly labelled as such, how
would the accessor know that he was committing unauthorized access ?

this is quite similar to sites say, accidentally exporting windows or nfs
shares out to the internet. a query of the server will return a mount
request legitimate.

Regards, /\_/\ "All dogs go to heaven."
dinesh@alphaque.com (0 0) http://www.alphaque.com/
+==========================----oOO--(_)--OOo----==========================+
| for a in past present future; do |
| for b in clients employers associates relatives neighbours pets; do |
| echo "The opinions here in no way reflect the opinions of my $a $b." |
| done; done |
+================================================= ========================+

On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:

> AFAIK, "hacking" is legally defined in the USA as being unauthorized
> access to computer resources. It doesn't matter if the resource was
> adequately protected (or protected at all) in first place or not. If you
> were not given permission to make use of that resource, you are
> criminally liable.

which begs the question, unless it was explicitly labelled as such, how
would the accessor know that he was committing unauthorized access ?

this is quite similar to sites say, accidentally exporting windows or nfs
shares out to the internet. a query of the server will return a mount
request legitimate.

Regards, /\_/\ "All dogs go to heaven."
dinesh@alphaque.com (0 0) http://www.alphaque.com/
+==========================----oOO--(_)--OOo----==========================+
| for a in past present future; do |
| for b in clients employers associates relatives neighbours pets; do |
| echo "The opinions here in no way reflect the opinions of my $a $b." |
| done; done |
+================================================= ========================+