The KGB the Computer and Me

The KGB the Computer and Me Appeared on the program Nova in the early 90’s Describes an attack on Berkley computers taking place almost exactly 20 years ago and the response to it. Based on the Book, “The Cuckoos Egg”

Computing in the late 80’s Most engineers and Scientists used mainframe computers. Mainframes were accessed locally using terminals Terminal is a keyboard, and screen with no computer. Mainframes were accessed from remote locations using modems, and dial-up connections Mainframes belonging to Universities, Defense Department researchers and some businesses were linked by an early version of the internet

Home Computers Home Computers were available IBM PC Apple Macintosh They were expensive and limited by today’s standards

Home Computers Home computers could communicate to Mainframes using modems and dialup connections. Terminal emulators allowed the home computer to simulate a terminal File transfer software, like Kermit, allowed files to be uploaded and downloaded to the mainframe No World Wide Web yet.

Clifford Stoll Astronomy Student turned Computer Security Expert His book, “The Cuckoo’s Egg”, was the first real exploration of the computer security problem. Currently sells Klein Bottles on the Internet

Clifford Stoll His later books are skeptical of the role of computers in Society “High Tech Heretic: Why computers don’t belong in the classroom and other reflections by a computer contrarian” “Silicon snake oil : second thoughts on the information highway”

Markus Hess Was tried and convicted, and sentenced to 2 to 3 years in prison The sentence was suspended He now works writing networking code for a computer firm in Germany

Some Questions What attack types did the Hacker Use? What were the hacker’s motivations? Do you think this could happen today? How was the hacker detected?

Attack Types Hess originally gained access to systems by gaining access to an existing account (swentec) Its not covered in the film, but he used several methods of password guessing We call this approach Impersonation

Attack Types Once Hess gained access to a system, he became “superuser”, (Unix slang for the administrative user He did this by exploiting a flaw in the email system For the record, this was our old friend, the buffer overflow exploit We call this, “Privilege Escalation”

Attack Types Once superuser, he hid all traces of his attack and created accounts he could use later. He then typically left the system. Later he would log on using one of the accounts he created. From this account, he could launch attacks on other systems without being traced back to his home This is similar to the behavior of modern worms.

What Were Hess’s Motivations? Ideas? Did the motivations of Hess and his companions change as time went on?

How was the attack Detected Ideas?

How was the attack Detected Initial detection was because of a minor accounting error Tracing the activity once detected was extremely difficult Hess passed through many systems The systems were in many legal jurisdictions Many technicians and law enforcement official were ultimately involved.

How was the attack Detected The final technique Stoll used is called today, a “honeypot” Create something the hacker wants Use it to draw him/her to the site, and keep him there while tracing and identifying the hacker This technique is often used today in child pornagraphy investigations

Can it Happen Today Thoughts?

Final Thought This case is still important today because it is one of the few times a hacker has been caught, prosecuted and convicted. It still remains extremely difficult to trace the source of attacks We solve more cases, (%), involving serial killers than hackers. Next case, Mr. McGinnis and the flying saucers