Text File

RISKS-LIST: RISKS-FORUM Digest Friday, 18 September 1987 Volume 5 : Issue 37

FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Contents: Another prison inmate spoofs computer, this one gains freedom (Bill Weisman) detroit flaps flap (Barry Nelson) AT&T Computers (PGN) Hackers enter nasa computers (Mike Linnig)

The RISKS Forum is moderated. Contributions should be relevant, sound, in good taste, objective, coherent, concise, nonrepetitious. Diversity is welcome. Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM. FTP back issues Vol i Issue j from F4.CSL.SRI.COM:<RISKS>RISKS-i.j. Volume summaries for each i in max j: (i,j) = (1,46),(2,57),(3,92),(4,97).

----------------------------------------------------------------------

Date: Mon, 14 Sep 87 14:58:44 PDT From: <cit-vax!elroy!billw%jplpub1.jpl.nasa.gov@RUTGERS.EDU> (Bill Weisman) To: risks@csl.sri.com Subject: Another prison inmate spoofs computer, this one gains freedom

From the Los Angeles Herald Examiner, date unknown

FAKE COMPUTER MESSAGE FREED DRUG KINGPIN By Bill Johnson, Herald staff writer

One or more Sheriff's deputies or civilian employees inside the Los Angeles County Jail aided an alleged cocaine dealer's escape from custody, Sheriff Sherman Block said yesterday.

Block said a computer message directing jailers to release William Londono could only have been generated by one of the nearly 70 deputies and civilians assigned to the jail the morning of Londono's Aug. 25 escape.

It is also clear, Block said, that someone inside the jail assisted Londono once he left his jail cell to avoid a series of checkpoints where his release would have been reviewed and found to be in error.

"The most troubling aspects of this [are that] we don't know exactly how this happened, and the apparent complicity of someone in this building," Block said.

A team of twelve investigators hasn't yet determined who sent the computer message or how Londono, 23, was able to slip out of the jail virtually unnoticed. Ordered held in lieu of $3 million bail on charges of conspiracy and possession of narcotics for sale, Londono wasn't discovered missing until Monday, six days after his escape.

Any jail employee who could have been even remotely involved is being interviewed, Block said. No action has been taken.

Exactly how Londono was able to bypass as many as five security checkpoints unnoticed remains a mystery, Block said.

"We are able to trace Londono's exodus to a particular point, but haven't been able to go any farther," Block told reporters as he led them from Londono's former jail cell to a holding area where inmates are released. Clothes Londono wore into the jail, for example, are missing, but there isn't any record of him or anyone else retrieving them, Block said.

Investigators on Wednesday determined that the jail's computer system could not have been accessed from outside the building, Block said. It is "highly unlikely" that the release message was sent in error, the sheriff added.

There have been two escapes from the maximum security Central Jail during the past two years. In both instances, inmates switched identification wristbands with soon-to-be-released prisoners, and walked out.

Block said the department has conducted an "almost X-ray type evaluation" of the inmate release process, and have added additional security measures to ward against a similar escape.

"No one is going to leave here today, tomorrow, or at any time in the near future by the same method," the sheriff said.

------------------------------

Date: Fri, 18 Sep 87 8:40:10 EDT From: Barry Nelson <bnelson@ccb.bbn.com> Subject: detroit flaps flap To: risks@csl.sri.com

According to a Boston Globe article, relatives of persons killed in the recent Detroit crash have filed a suit against the airline. Part of their filing apparently contains claims that the Cockpit Voice Recorder reveals not only the omission of the flap setting during pre-flight checklists (in violation of FAA and nature's rules) but also a discernible voice shouting at the last second, "Oh, [expletive deleted] flaps!" (as in, "oops")

The interesting part is that they go on to discuss the 'circumvention' of a circuit breaker which had de-activated the automatic flaps warnings. Does this mean they could have had multiple systems fed throught the same breaker but that the flaps warning is the only one that was inadvertently shut off?

In my experience with Aviation Electronics (Avionics), most modern indicators have a big 'OFF' flag, usually orange or red-and-white-striped, dropped across the face when required power is missing (or a blank CRT). Being unfamiliar with complete jet panels, I can only speculate that there is an observable flaps-setting indicator which might be a good place to show subsystem outages. (I recall at one Aerospace company where I worked, they went to great lengths to run test signals through EVERY required harness, connector and subsystem so as to detect outages at various points and interlock man/mission-critical processes, not to mention announcing alarms.)

Is there a System Safety Engineer in the house? Who is responsible for getting the data from one system to the other so as to be easily interpreted as a hazard? Are we to expect an obviously fallible checklist to overcome this?

"This document contains statements of opinion by the author which are not attributable to BBN Communications Corporation or its management."

Barry C. Nelson /Network Consultant/Product Liability and Certifications Group BBN Communications Corporation / 150 Cambridge Park Drive, Cambridge, MA 02140

------------------------------

Date: Fri 18 Sep 87 11:06:48-PDT From: Peter G. Neumann <Neumann@csl.sri.com> Subject: AT&T Computers To: RISKS@csl.sri.com

Today's Washington Post and yesterday's Chicago Tribune had articles on Herbert Zinn, who apparently broke into a variety of AT&T UNIX systems and copied some sensitive files -- including a pre-release version of an artificial-intelligence program valued at $1,000,000 in potential sales. The articles contain considerable misinformation but again indicate the intrinsic difficulties in making systems secure.

------------------------------

Date: Tue, 15 Sep 87 20:40 CDT From: Mike Linnig <LINNIG%eg.ti.com@RELAY.CS.NET> Subject: Hackers enter nasa computers To: risks@csl.sri.com

Ft. Worth Star Telegram:

Reports say West German hackers broke into NASA computer system

FRANKFURT, West Germany (AP) -- Computer hackers broke into NASA's worldwide data network throughout the summer and gathered secret information on space shuttle projects and rocket failures, West German media said Tuesday. News reports said young West Germans gained regular access to at least 20 computers of the U.S. space agency and had the ability to paralyze the entire network. The ARD television network said a flaw in the network's security system allowed the hackers to enter the network from May to September. Hackers are computer enthusiasts who often try to break into private computer systems for the challenge or for criminal gain. The NASA system connects more than 1,600 computers worldwide that share information on space research, nuclear physics and molecular biology, ARD said in a report broadcast Tuesday night. The network includes U.S. atomic research facilities in Los Alamos, N.M. In Washington, the National Aeronautics and Space Administration said in a statement that the tapped network provides unclassified information to university and industry researchers. "We know of no classified information which can be accessed through the network," the statement said. The statement said NASA uses a number of computer networks with varying degrees of security to provide "appropriate inviduals" with access to data. The Hamburg-based magazine Stern reported information similar to the ARD report in an advance telexed to news media Tuesday. "When I saw "Welcome to the NASA headquarters . . . installation' on my screen, I was a little shocked, to say the least," the magazine quoted one youth as saying. The Hamburg-based "Chaos Computer Club" said in a statement to news media Tuesday that the youths turned to the club for help when they realized the enormity of their discovery. The statement said the hackers penetrated the network to show the "unbelievable weaknesses" of the security system and had no interest in the secret data. The reports did not say how many hackers were involved or where they lived. Stern said the youths obtained NASA memos to employees on daily space shuttle program updates and on how to deal with the media. The magazine, quoting one youth's records of computer transactions, said the hackers were able to read users' electronic mail and had the ability to paralyze the entire network. In one of the most serious security breaches, the hackers obtained NASA information on space shuttle projects, computer security studies and rocket boosters, the television network said. Scientists in at least eight other countries besides the United States are linked to the computer network. Stern said the system is called the "Space Physics Analysis Network," or SPAN. Michael Butz, a spokesman for the West German Interior Ministry, said his office had no information about the incidents. The Interior Ministry supervises many police functions in West Germany. In addition to the NASA computers, the hackers gained access to computers at some of Europe's most sophisticated research institutions, including the European Space Agency in Darmstadt, West Germany; the European Nuclear Research Center in Geneva, an the European Laboratory for Molecular Biology in Heidelberg, West Germany. Lennart Philipson, director of the molecular biology laboratory, said the institute is re-evaluating its use of the computer network. "We are considering whether we should restrict our exchange of data with other institutes, even if that might hinder our research," Philipson told ARD. The hackers said they gained access to the NASA computers by asking for files stored under such key words as "shuttle," "challenger," and "secret," ARD said. Under those categories, the hackers said they saw data reports on "Shuttle C Study Contracts," a "System Security Study" on computer security, and a study on "Booster Rocket Incidents," the television network said. The hackers described a step-by-step process of gaining more and more access to the network's computers until they achieved "unlimited access" to all data banks and the ability to "manipulate at will" all information stored there, according to ARD. ARD said the hackers provided more than 200 pages of documents pertaining to entry into the NASA computers for Tuesday night's television broadcast. The computer club said the penetration was discovered in August and all organizations who use the network were notified. So far, no charges have been filed in the case. Justice Ministry spokesman Henning Gehl said the hackers' actions are punishable by up to three years in prison and fines.

------------------------------

End of RISKS-FORUM Digest ************************