Softpanorama, March-April 1997; v.9.No.2(91a) Compiled by N.Bezroukov

# Softpanorama Security News

## Woman diagnosed with Net addiction disorder

Cincinnati woman allegedly locked her three children in a room with broken glass, debris and child handprints of human feces on the wall. Police say she was so addicted to cruising the Internet that she didn't want to be disturbed. She faces a court appearance Monday on three counts of child endangering. Her estranged husband turned her in Saturday. The children - ages two, three and five - are in police custody.

Experts already have a name for the problem: Internet addiction disorder. Just like any other addiction, it can displace the drive to eat, sleep or earn a living.

By The Associated Press

## Hackers Steal Code For Popular Game

Hackers once again demonstrated the vulnerability of the Internet by breaking into the computer system of a game company and stealing the source code for Quake, a popular 3-D game.

The hackers broke the Web site of Crack dot Com Inc. in Austin, Texas. Crack dot Com co-founder Dave Taylor, who used to work for id Software, the maker of Quake, was working on a port of the game. The hackers downloaded the Quake code and replaced Crack dot Com's home page with their own page that offered links to the software.

Taylor called the FBI and is trying to track down the hackers. He believes they were motivated by mischief, not profit. Id, in Mesquite, Texas, says it doesn't think the code was widely distributed.

## Macro viruses became most prevalent type of computer viruses

Virus infections are tripling in US big business over the last year. Although anti-virus products are being used more than ever before, macro viruses in documents distributed by e-mail are wreaking havoc and account for much of the increase, according to the National Computer Security Association (NCSA) which conducted the study. More than 40% of all PCs in surveyed companies get a macro virus in a year, according to the study. The survey also found that electronic mail is now one of the leading methods of transmitting viruses. 80% of all infections were macro viruses, up from 49 per cent a year ago. The most prevalent viruses are Word.Concept and Wazzu, both stemming from Word documents.

(04/17/97, ZDNet UK)

## Extortion Plot Against Bill Gates

The FBI posed as Microsoft Chairman Bill Gates on an online dating forum to nab a 21-year-old Illinois man charged with trying to extort $5 million from the billionaire by threatening his life. Adam Quinn Pletcher, described by law enforcement officials as a loner who spent hours in front of his computer, sent several letters to Gates demanding 5 millions and asking the world's richest man to respond to an America Online dating service known as ``NetGirl.'' But instead of Gates the return messages were sent by FBI agents who arrested Pletcher May 9 after tracing his name from a list of hundreds of AOL subscribers. FBI agents went to Pletcher's house in an affluent suburb north of Chicago, where he admitted to making the threats. He faces up to 20 years in prison if convicted, but the actual sentence would likely be below that. Gates' life never was in immiment danger, no money was paid and law enforcement officials said Pletcher appeared to be carrying out a fantasy. It's unclear whether Gates will change a lifestyle in which he often appears in public without guards.

(5/16/97) Seattle Post-Intelligencer

## MS Word corporate image suffer from macro viruses
Microsoft switched to the damage control mode and started anti-virus initiative

In an effort to limit damages to MS Office from macro viruses Microsoft Corp. recruited the National Computer Security Association - private consulting firm that represent mainly antivirus software vendors. They announced the Macro Virus Prevention Initiative that will includes an anti-virus developers' newsgroup and a Web site to aid in the prevention and detection of viruses in Microsoft applications.

The newsgroup will contains essential Microsoft Office and DBA file formats that enable antivirus vendors to detect macro viruses in MS Word 97 , as well as a "secure" bulletin board - open forum for vendors' questions,

Early beta versions of Microsoft applications will be available to anti-virus vendors via the newsgroup.

Users will have their own area on the site that provides macro virus information, as well as news on the anti-virus tools built into Microsoft Office and products from third-party vendors.

Microsoft also opens its own AV Web site is at www.microsoft.com/office/antivirus. The only useful information it currently have is PREVENTION.DOC - new protection macros for MS Word 97 that give users possibility to assign password to Normal.dot. See http://www.microsoft.com/office/antivirus/word/wordprot.hm

## Specialized AV Tools became more popular

Instead of going after each and every virus new generation of products goes after more prevalent viruses.

It does disinfect most boot sector and macro viruses--which currently account for around 90% of real-world virus infections but not file viruses.

For file viruses it's simpler for network administrators to deny access to infected files and encourage users to get new copies than to disinfect the files.

Integrity checkers primary function is not virus eradication, but virus prevention.

## 'Push' Has Its Uses, but Infrastructure Must Beware

Push technology can keep you up-to-date on every crime story, every love triangle or quadrangle in soap opera, and every small-time basketball score that you've bet a few bucks on. And the best part is that you can get all this information while you look like you're working! You're supposed to be writing code for the new accounting app, but you're really catching the final race results from Pimlico. Great stuff.

Maybe it isn't that bad in your company. Just wait. But with many of the push vendors--including PointCast, Intermind, etc.--coming up with full new revs of their products, and Microsoft and Netscape trying to trump them all with their own push systems

Anarchy that has made the Web its own strange world. And information overload is already high. While prospective push content developers are spending their hours perfecting channels that will be able to push their latest great thoughts and ruminations out instantaneously, those who responsible for company's IT infrastructure should probably spend a couple of hours figuring out how to filter the plethora of push-based information coming your way.

This materaial is based on the article by Eric Lundquist, 02/24/1997 PC Week

## New NT password cracker

The group of hackers, called the L0pht (pronounced 'loft'), has posted on the Internet a cracker called Lophtcrack. It use two other separate NT cracker oriented programs: PWDump and NTCrack. The LOphtcrack hack is a GUI based cracker that adds a spreadsheet-like interface atop PWDump. LOphtcrack "sets up columns of the user lists, what their passwords. When you click 'Run,' it just starts decrypting all the passwords.

The hackers who have taken on NT in recent weeks are members a worldwide network of code breakers who communicate over the Internet via electronic-security mailing lists, Usenet groups, FTPs and Web sites. In recent months, the community appears to have shifted its attention from Unix- and encryption-cracking techniques to take aim at Windows NT, which has begun to find favor among corporate users.

"..Microsoft is shoving stuff down people's throats, and you don't have the ability to look and see how good it is," Cracker author told EE times "They're saying, 'Trust us; it's secure.' "

PWDump is a program, written by Jeremy Allison, a programmer at Cygnus Solutions (Sunnyvale, Calif.) and it is included in L0phtcrack's "tool kit." Also included is an additional "dictionary attack" program that uses a "brute force" method. That program goes beyond the capabilities of the previously reported NTCrack dictionary program.

L0phtcrack require that the user have network-administrator privileges to access a password-encryption file. Unauthorized access to an administrator account can only happen in three major ways:

- One is that the administrator is a "bad guy".
- Second, the administrator could inadvertently do something he didn't mean to do or reveal the password to the person that is trying to break into the system.
- And the third is to use the administrator login on the account, doing things that should NOT be done from this account like WEB browsering. . . [That is where] a Trojan horse gets involved in that system and compromises it."

Second version of L0phtcrack, due to be available within a few weeks, promises that a user would not need to be an administrator or have an administrator's password. Guset will suffice. But whether they will manage to achive that remain to be seen.

"You just have to be part of the NT domain to get these passwords. Remote access is obviously an easy way to become a part of the network, rather than having to physically go to the site and plug yourself into the network via a machine."

It's not so much the hacker at home who will be using these kinds of programs for malicious intent; it's more of the corporations with multiple master domains across Europe and America, with thousands of machines, with all kinds of proprietary and confidential corporate data at stake. Look at what American Express has on its NT network--thousands and thousands of credit-card accounts. This could all be pretty nasty.

Microsoft plan to release utility that permit use only strong passwords. They use this utility already at Microsoft for 22,000 employees.

User Login Dialog box on NT machines limits the amount of characters that can be typed to 14, though technically NT allows for up to 128 characters. So it is recommended to use at least 14 letter paswword for admin accounts as strength of the password increase with length.

But a big problem for NT is that users can access admin privileges fairly easily, right over the Internet, and then go back through an NT network and glean the password file list from the Security Accounts Manager (SAM

Using "sniffer" is the most common methodology used by hackers for gaining access to admin privileges on Unix and, more recently, NT systems. Sniffer programs are readily available commercially and are primarily used for network analysis. "Net Xray is one, TCP Watch and LANWatch from FTP Software , and there are free ones for Windows, such as Gobbler. Anybody can grab them off the Net.

Common "Trojan horse" form of attack would work as well. Most of the Trojans are done in the form of DLLs in Windows. It says 'Hey, I've got an administrator here; great. What do I want from him, what do I want him to execute for me?' The admin ends up running a program without even realizing it. The Trojan can also be written to say, 'Hey, I've got administrator here. Guess what I'm going to do: I'm going to dump the password file and then mail it to myself.

Security is a technical issue, but it's also a policy issue. One need to secure administrator password, make sure you don't use your administrator account for anything other than administrative work, and make sure that a policy of strong passwords is implemented in your corporate site.

This material is based on 05/18/97 article by Larry Lange. Full text of the article is available from: http://www.techweb.com/se/directlink.cgi?WIR199704160

## PWDump for NT

After security problems vexed its Internet Explorer Web browser Jeremy Allison, a programmer at Cygnus Solutions, Sunnyvale, Calif., detected another flow. Allison was working on a utility tool for migrating users from NT to Unix.

"All that my code does is expose the equivalent for a shadow password file on a well-administered Unix system. The root on a Unix system has access to the password file, and nobody says that is a security hole," Allison said. "Likewise on [Windows] NT, you would expect the administrator to have access to the administrator file."

Allison said his code found the same keys to password encryption in Unix systems that are found in administrators files in Windows NT systems. And no one would say that allowing administrators access to such password files is a security flaw.

The problem is Microsoft did not document that it was possible for a system administrator to access the password file, he said.

A program called Crack, used by some Unix systems administrators, goes after in-house passwords and finds vulnerabilities. With the utility, administrators can use NT Crack to tighten up NT security.

He said he expects Windows NT 5.0, slated for delivery next year, will be much more secure. In the interim, Service Pack 3 should contain additional security features when it comes out, such as a modification to the security-authentication protocol.

Allison said he knew where the password registry was encrypted, but not how to decrypt user's IDs. There were two fragments of code that he did not know of until an anonymous person in Australia posted them on a specialized hackers' newsgroup.

Microsoft officials maintain that commonsense security policies will keep NT's password registry safe. A customer's policies would have to be extremely lax in order for a hacker to gain access through the newfound utility. Microsoft officials said the odds of such a breach are so low that the company will not offer a patch or bug-fix for this potential problem.

This material is based in CMP Media Inc. TechWeb. Full text of the article is avalable from: http://www.techweb.com/se/directlink.cgi?CRN19970421S0077

## Extortion Plot Against Bill Gates (5/16/97) Seattle Post-Intelligencer

The FBI posed as Microsoft Chairman Bill Gates on an online dating forum to nab a 21-year-old Illinois man charged with trying to extort $5 million from the billionaire software mogul by threatening his life. Adam Quinn Pletcher, described by law enforcement officials as a loner who spent hours in front of his computer, sent several letters to Gates demanding 5 millions and asking the world's richest man to respond to an America Online dating service known as ``NetGirl.''

But instead of Gates the return messages were sent by FBI agents who arrested Pletcher May 9 after tracing his name from a list of hundreds of AOL subscribers. FBI agents went to Pletcher's house in an affluent suburb north of Chicago, where he admitted to making the threats, according to court documents made public in Seattle Thursday. He faces up to 20 years in prison if convicted, but the actual sentence would likely be below that under federal guidelines.

Gates' life never was in immiment danger, no money was paid and law enforcement officials said Pletcher appeared to be carrying out a fantasy.

Question rematins open whether Gates will change a lifestyle in which he often appears in public without guards.

## The Net is not safe for Social Security records

Government auditors say the Internet is a dangerous place for private Social Security records. "The Internet is not a secure environment," said Joel Willemssen, a federal auditor who reviews computer security for the General Accounting Office. Willemssen spoke Tuesday to the House Ways and Means subcommittee that oversees the Social Security Administration. The agency in April suspended a month-old program to offer people instant online access to their individual earnings and retirement benefit records after lawmakers raised privacy concerns.

Social Security is conducting a 60-day review of the program, with public forums in six cities that started in Hartford, Conn., this week. The House panel is conducting its own review.

For more that 10 years Social Security has accepted written requests by mail from individuals for their personal records. Last year the agency began taking requests online and then mailed out hard-copy records. It was a shift to instant access online in March that caused concern.

Various improvements have been suggested to make the service more secure, including giving users personal identification numbers or passwords.

The Associated Press