The KGB the Computer and Me

1. The KGB the Computer and Me

2. The KGB the Computer and Me • Appeared on the program Nova in the early 90’s • Describes an attack on Berkley computers taking place almost exactly 20 years ago and the response to it. • Based on the Book, “The Cuckoos Egg”

3. Computing in the late 80’s • Most engineers and Scientists used mainframe computers. • Mainframes were accessed locally using terminals • Terminal is a keyboard, and screen with no computer. • Mainframes were accessed from remote locations using modems, and dial-up connections • Mainframes belonging to Universities, Defense Department researchers and some businesses were linked by an early version of the internet

4. Home Computers • Home Computers were available • IBM PC • Apple Macintosh • They were expensive and limited by today’s standards

5. Home Computers • Home computers could communicate to Mainframes using modems and dialup connections. • Terminal emulators allowed the home computer to simulate a terminal • File transfer software, like Kermit, allowed files to be uploaded and downloaded to the mainframe • No World Wide Web yet.

6. Clifford Stoll • Astronomy Student turned Computer Security Expert • His book, “The Cuckoo’s Egg”, was the first real exploration of the computer security problem. • Currently sells Klein Bottles on the Internet

7. Clifford Stoll • His later books are skeptical of the role of computers in Society • “High Tech Heretic: Why computers don’t belong in the classroom and other reflections by a computer contrarian” • “Silicon snake oil : second thoughts on the information highway”

8. Markus Hess • Was tried and convicted, and sentenced to 2 to 3 years in prison • The sentence was suspended • He now works writing networking code for a computer firm in Germany

9. Some Questions • What attack types did the Hacker Use? • What were the hacker’s motivations? • Do you think this could happen today? • How was the hacker detected?

10. Attack Types • Hess originally gained access to systems by gaining access to an existing account (swentec) • Its not covered in the film, but he used several methods of password guessing • We call this approach Impersonation

11. Attack Types • Once Hess gained access to a system, he became “superuser”, (Unix slang for the administrative user • He did this by exploiting a flaw in the email system • For the record, this was our old friend, the buffer overflow exploit • We call this, “Privilege Escalation”

12. Attack Types • Once superuser, he hid all traces of his attack and created accounts he could use later. • He then typically left the system. • Later he would log on using one of the accounts he created. From this account, he could launch attacks on other systems without being traced back to his home • This is similar to the behavior of modern worms.

13. What Were Hess’s Motivations? • Ideas? • Did the motivations of Hess and his companions change as time went on?

14. How was the attack Detected • Ideas?

15. How was the attack Detected • Initial detection was because of a minor accounting error • Tracing the activity once detected was extremely difficult • Hess passed through many systems • The systems were in many legal jurisdictions • Many technicians and law enforcement official were ultimately involved.

16. How was the attack Detected • The final technique Stoll used is called today, a “honeypot” • Create something the hacker wants • Use it to draw him/her to the site, and keep him there while tracing and identifying the hacker • This technique is often used today in child pornagraphy investigations

17. Can it Happen Today • Thoughts?

18. Final Thought • This case is still important today because it is one of the few times a hacker has been caught, prosecuted and convicted. • It still remains extremely difficult to trace the source of attacks • We solve more cases, (%), involving serial killers than hackers. • Next case, Mr. McGinnis and the flying saucers