Once again, this is Dr. Michio Kaku for Radio WBAI, 99.5 FM on your dial,
broadcasting from the Empire State Building. Good evening.
WBAI is proud to present Homefront, Pacifica Radio's Town Hall Meetings,
a five-part national satellite series. Tune in on Friday at 7 p.m. for Part 1,
Disorder on the Border, a look at immigration in the United States from our Pacifica station,
KPFT in Houston. Disorder on the Border will look at immigration quarters, who's allowed in and
who's not, and how new immigration will affect the United States job market in the next 10 years,
illegal immigration and border violence, and the free trade agreement's impact on Mexico
and the United States. Hosted by Pacifica Radio's Larry Bensky, Disorder on the Border will feature
a distinguished panel of immigration officials, activists, and journalists from around the country
discussing one of the most pressing issues of the 1990s. That's Homefront, Pacifica Radio's
Town Hall Meeting, Disorder on the Border, Friday, June 28th at 7 p.m., only on WBAI, 99.5 FM.
And this is WBAI in New York. It's nine o'clock. Time for Off the Hook.
The telephone keeps ringing, so I ripped it off the wall. I cut myself while shaving, now I can't make a call.
It couldn't get much worse, but if they could, they would. Bum, diddly, bum, for the best, expect the worst.
I hope that's understood. Bum, diddly, bum!
And a very good evening to one and all. The program is Off the Hook, and this is a man
with you for the next hour, talking about high-tech and low-tech and the risks thereof.
We're going to have a special guest today, some people formerly associated with the Legion of Doom.
We'll be getting to that in just a few minutes.
And of course, we'll be welcoming your phone calls at 279-3400.
We'll be getting to that in just a few minutes.
We'll be getting to that in just a few minutes.
¶¶
Yes, we are all prisoners in one form or another.
And here, on Off the Hook, we're trying to wake you up a little bit to the things that are going on outside.
And there are many exciting things happening.
Just today, for instance, there were two major phone outages that nobody can explain.
The first one happened in Washington, D.C., affected the city of Washington, D.C., Maryland, Northern Virginia.
Allegedly, a software glitch.
And then on the West Coast, Pacific Bell does not understand why calls were failing all day long.
And no doubt, we'll be reading things about that in tomorrow's newspapers.
And there was a fiber cable cut in Annandale, Virginia.
It knocked out the Associated Press' audio feed for their radio news service.
But they have a backup routing system.
And that backup routing system switches transmissions to a second cable if the first one fails.
Awfully intelligent to have a backup.
But!
According to a spokesperson for the Associated Press,
somehow they both ended up being hit by this incident.
Sorry!
Bit CC by any lighter company.
Otherwise it findet anything bad.
It I would never be.
It's a fail at the WAÇ.
As we trigger the ATV.
Thank you.
Thank you.
Eighteen months ago, I had my wallet stolen.
This is a story from Tsutomu Shimura.
I had my wallet stolen about 18 months ago.
Upon canceling my credit cards and receiving replacements, I was somewhat surprised to discover that one of them looked very familiar.
It had an account number which was one greater than the one I just reported stolen.
The final digit is a checksum uniquely determined by the preceding digits.
As it would be bad for a credit card thief to be able to trivially predict the account numbers of replacement cards, I had written this off to coincidence.
This card was lost last week and I just received the replacement.
And the account number followed the same obvious pattern.
It is still possible that the sequence is coincidental, but it would seem most unlikely given the number of possible account numbers.
And here's something from the Dilbert comic strip on June 13th.
Man talking to his dog.
It's an ethical dilemma.
I support my company's goal of discouraging drug use, but the random drug testing policy is a violation of my constitutional rights.
I'll get fired if I refuse the test.
Man using the computer and talking to dog and himself.
Sometimes the straightest path is through the mud.
Dog responding to man.
Good.
Rationalize it with an obtuse metaphor.
Rationalize it with an obtuse.
Rationalize it with an obtuse.
But our credit, our credit files that are continuing to mount up.
And just this past Saturday's New York Times, an article about credit bureaus drawing fire for misuse of data.
Credit bureaus, the nation's clearinghouses for consumer credit information, are under attack.
Some members of Congress, consumer advocates, and individuals say the credit bureaus have inaccurate data.
And don't keep a tight lid on their files.
The bureaus in response say that their information is correct, that they try to correct errors quickly, and that only subscribers, primarily grantors of credit, with legitimate needs have access to files.
Credit reports are vital to the functioning of the bureaus.
Credit reports are vital to the functioning of the credit system, the bureaus say.
One of the recurring charges is that the credit bureaus place wrong, ambiguous, or outdated information in consumer files.
An individual can find out what is in his or her credit file, but only on request, and only for a charge.
Unless your credit is denied for some reason, and then you can do it for free.
But by then, of course, it may be too late.
The credit controversy is something that we've talked about in weeks past, and something that no doubt we'll be devoting time to in the future.
And one final interesting bit here from New York Newsday.
Hold the phone, says Mitsubishi, sues AT&T over $430,000 in calls that breached security.
Yes, the busy signals must have been maddening.
Three years ago, Mitsubishi International leased a device known as a private branch exchange.
We call them PBXs.
They leased this from AT&T, its corporate neighbor on Madison Avenue.
The electronic hardware was like a private phone company.
Among other things, it allowed employees away from the office to dial an access code and get onto a long-distance line at Mitsubishi.
Now, at that particular moment, a lot of people get lost.
They don't know what is being referred to.
So we're going to do something that the newspaper articles cannot do.
And that is grab a dial tone and make an outgoing call.
And hopefully, if our correspondents are correct,
we have correspondents in the street, literally, who are feeding us numbers.
And these numbers go to what is known as PBXs or also extenders.
An extender is, well, imagine if you called a telephone number.
And instead of getting a ring, you received a dial tone.
And with that dial tone, you could dial anywhere in the world.
Well, there's that dial tone.
Let's try dialing.
We'll dial five.
Oops, we dial two fives.
We'll dial another five.
Three fives.
We'll dial four fives.
One more five.
It's accepted five fives.
We don't know what's going to happen.
Another five.
All right.
We've done something wrong.
But we've also found out that the access code is six digits.
And we can also tell what kind of a system it is
by the sound of that little siren that we heard.
All right.
Let's try another one.
And these are all 800 numbers.
And, yes, the record is skipping.
We know that.
Okay.
We have another one.
Let's try fours.
One four.
Another four.
Three fours.
Interesting.
This one is a bit more sophisticated.
Let's hit a star.
Pound sign.
I'd have to rank this one as having fairly good security
since you don't know how many digits the code is.
And that's eventually what happens.
A hacker would have a tough time with that one.
All right.
We're going to try one or two more.
And then we'll finish with the article
and get on to our special Legion of Doom feature.
All right.
Let's try this one over here.
Of course, I cannot reveal where these numbers are winding up.
But this is a live demonstration.
Okay, there we heard the ring and we heard the dial tone.
So let's hit a zero.
And we've got another dial tone.
Hey, we've gotten someplace.
Let's dial an eight now.
A five.
A two.
A one.
A six.
Whoops.
A six.
A nine.
A zero.
A star and a pound sign.
Well, the pound sign seems to have set it off in some way.
And that apparently means something.
That's what an extender is.
And that's what a PBX is capable of doing.
And that is...
In a nutshell, what it's all about.
So, last July, a number of employees started complaining
that they could almost never get through.
And why could they almost never get through?
They would dial a number very much like the ones that we were dialing,
but they would get a busy signal instead of a dial tone.
Someone was getting through.
People making illegitimate calls.
Now, what's unusual here is that Mitsubishi is blaming AT&T for this.
Mitsubishi and New York telephone technicians audited the company's long-distance records in August,
a month after employees started to complain and made a disquieting discovery.
More than a million dial-ups in which the caller attempted to get a long-distance line
without the correct access code had been logged.
Most of the calls were to places like Pakistan and Egypt.
Apparently, employees were not involved.
When Mitsubishi got its bill for the phony calls,
it refused to pay AT&T,
claiming that the telecommunications giant never adequately warned it
about the risks of the equipment.
And to drive home its point,
Mitsubishi filed a lawsuit against AT&T last week
that asks for more than $10 million in punitive damages
and seeks to have charges dropped for the calls to Pakistan and Egypt.
The Mitsubishi case filed in U.S. District Court in Manhattan
is not unusual, law enforcement officials say.
According to Donald Delaney,
senior investigator for the New York State Police,
it's a multi-million dollar business.
Delaney said there is a black market for stolen access codes
that enable users to dial into private branch exchanges such as Mitsubishis.
I think the point that needs to be driven home here
is that these systems are extremely easy to crack.
And you can very simply program a computer
to one by one, go through all the digits.
You can get the access codes through humans
that work at various companies.
Sometimes they even all have the same algorithm.
In other words, they all add up to the same number.
So it's very easy to determine what they are.
And once you get this,
you have a free way of making calls all over the world.
Not too nice, but it is happening every day.
In a moment, we'll be talking to
former members of the Legion of Doom
who have gone respectable.
Here on Off the Hook.
And then we'll be taking your phone calls
at 212-279-3400.
One more time, my pleasure.
We'll be right back.
Hey, hey, hey.
Hey, hey, hey.
Hey, hey, hey.
Hey, hey, hey.
Hey, hey, hey.
We'll be right back.
We'll be right back.
We'll be right back.
Hometown, hi-fi, who killed King Tubby?
I'd defy anyone in this country to get a copy of this because Island Records still refuses to put it out in this country.
Oh, well.
We heard, as I said, screaming target, who killed King Tubby?
The program is off the hook.
This is Emmanuel Goldstein with you until 10 o'clock.
And yes, PBX fraud is not the only thing we're going to be focusing upon tonight.
We're also focusing upon something that is unfolding even as we speak.
That's right.
But we've been following various stories concerning computer hackers in the past.
And one of the groups whose name has been mentioned several times, rightfully, wrongfully, all kinds of ways, is the Legion of Doom.
And now there's an interesting postscript to the Legion of Doom.
Let's take a look at Time magazine, June 24th.
After infiltrating some of America's most sensitive computer banks, is there any challenge left for a digital desperado?
Only to go legit, say three former members of the notorious hacker group, the Legion of Doom, who have quit the outlaw game to start ComSec Data Security.
The Legionnaires, pardon the expression, claimed an 80% success rate in penetrating computer networks, and now they want to teach private industry to protect itself from the next generation of intruders.
You can't put a price tag on the information we know, says Scott Chasen, the ComSec partner, but they'll try.
And we have the guys on the phone with us now.
Do we have Scott Chasen there?
Or is this Chris?
Yeah, I'm here.
Which one is this?
It's both of us.
Oh, it's both of you.
Okay, great.
Now, you have formed this new group, ComSec Data Security.
And are you both former Legion of Doom members?
Yeah, as a matter of fact, I was one of the original nine members when the group founded in 1984.
Well, now, perhaps you might want to say something to people listening who might think that the Legion of Doom was sort of like, you know, Iraqi terrorists or something, the way they've been portrayed by the media.
What's the facts as you know it?
Well, the facts as I know it.
And as I've said several times in the past, the best description that you could ever have of a Legion of Doom is a bunch of bored adolescents with too much spare time and access to computers.
You know, we weren't organized crime.
We weren't communist-backed miscreants.
We were all normal teenagers who just happened to have an interest in computers.
And it just stemmed from that.
So there was never anything malicious on anyone's mind?
No, no, certainly not.
The intentions were always to seek knowledge.
Uh-huh.
Now, how would people go about seeking that knowledge?
Well, by any means possible, basically.
If there was a system out there that someone wanted to know about, they would usually find out everything they could about that system,
whether it meant, you know, reading whatever books that were available on that particular type of system,
or by going out and obtaining access to that system in one form or another.
Uh-huh.
Now, a year ago, things were quite different.
The Legion of Doom was in a lot of newspapers, being accused of all kinds of things.
Do you feel the name has been vindicated at all?
Vindicated?
I don't really know if that's the word I'd use.
Uh-huh.
You know, there's still a stigma attached to Legion of Doom.
Um, it's not, it's not really something that a lot of people would have thought that we could cash in on to use in a positive manner.
But what we're trying to do with our organization here is to turn the public sentiment around.
We want to show that we've got this knowledge and we want to use it for positive means rather than to keep it,
to keep all this contained within the underground.
So, that was our intention with forming ComSec with past members.
Now, how many members are involved?
Well, from, there are three of the four founding members were members of Legion of Doom.
And there are three others who are also members of the Legion who will be most likely joining us in a short period.
Uh-huh.
Have you gotten much feedback from the computer underground?
See, the underground, it's funny.
We expected a huge amount of flack from people in the underground.
We thought everybody would think, well, LOD's sold out and LOD's feds and they're going to turn in everybody and everybody watch out because LOD's evil now and they go against the underground.
But that's not what we got.
We got, everybody thinks it's great.
Everybody, you know, seems to be behind us in this endeavor.
However, the flack, interesting enough, is coming from the computer security industry.
For whatever reason, they don't seem to like the idea of computer hackers forming this kind of an entity.
They don't want to see what they always saw as the opposition switching sides.
Or they don't want to see their weaknesses exposed.
Possibly.
I can't speak for them.
I can only speak on behalf of what we've seen.
Uh-huh.
There's a lot of, some kind of deep-rooted sentiment against us in one form or another.
But without getting too specific, can you describe that a little bit in more detail?
Scott, you want to say something?
Uh, I don't want to go into the subject too detailed because we will trample some toes.
But I will tell you that one of the last articles that was written about ComSec data security was in the Houston Chronicle.
And a trade association in California was mentioned.
And one of the employees of that trade association talked about our company and what they thought about it.
And they personally thought it was a great idea that hackers would be computer security consultants.
Because who best to hire than someone that, you know, that's the reason why computer security consultants are around, to keep hackers out.
But back to the point is that basically the industry out there, the computer security industry, feels that they're threatened for many reasons.
I think that one of them might be because they still think of us as the enemy.
You know, they've been, this is the reason why they have jobs.
This is the reason why, you know, we put money in their pockets because this is what we've done for the last 10 years.
And now the tables have turned with us and they're scared.
I think they're a little bit, they're a little jealous also.
We're getting all this press.
And possibly, like you said, because we could be showing their vulnerabilities.
You know, we just got back from a hackers conference in St. Louis this past weekend.
And I took a poll and everyone that was there admitted to me that corporate computer security out there is a joke.
And I don't know what these computer security consultants are doing now, but they're certainly not doing their jobs.
And maybe that's why they're scared.
I mean, you can ask any computer hacker out there in the underground, and they will tell you that security is no problem.
That's why we've set this ratio of 80% success rate and system penetration.
You know, if Company X wants to come in and ask us to present ourselves to them for a possible contract,
we're going to get a computer out and we're going to show them, and we're going to show them their weaknesses.
And out of 100 corporations, I guarantee that we'll get into 80 of them and show them their weaknesses.
Now, when you say you're able to get into 80%, I mean, are you just trying to get in through default passwords?
Are you using...
Through any number of methods.
I mean, we would take the approach in what we're calling systems penetration testing.
We're going to take the approach that we know nothing about you or your company.
We're going to try to get in as if we were an outsider, whether it be hacker, whether it be corporate spy.
We're going to approach your system in that light.
We're going to go use every means available to try and breach the security of your system.
Whether that means, you know, going in and trying standard defaults.
Whether that means going, you know, walking into the building as a courier.
Whether that means jumping into the trash.
We're going to take...
We're going to show them.
These are all avenues that they need to be aware of.
That people are going to try to get into a system.
And if there's a weak link in the chain anywhere, it could break.
You need to have all these avenues explored.
And, you know, that's what we do for our external system penetration testing.
Now, are you working with phone systems as well as computer systems?
Yes, we are.
You know, there are a lot of phone systems out there that, as Chris was saying, are the weak link.
They come into play.
You know, there's a collage of things that makes up a tight security around the computer.
And if the system is hooked up to a poor phone system, well, that certainly could make a break in the chain.
And that's something we're going to focus on also.
You know, but as far as the system penetration goes, you know, we feel confident in the fact that corporate American security is a joke.
And a lot of, you know, a lot of people know this.
And that's why we feel that maybe the security industry is getting kind of upset about this.
Maybe that we're going to be showing them some kind of vulnerability in themselves.
They don't want their bosses to find out about us.
Now, are there any particular kinds of systems that seem to be more open than others?
Everything, everything's got its weak points.
And a lot of them share common weak points.
One system that seems to be in the forefront with security flaws, mainly it's probably because it's one of the industry standards.
And that's particularly what we're going to concentrate on is any Unix-based operating system.
So we feel that to be our strong point.
And that's the kind of systems that we're going to target.
The people who operate those types of systems, those are the clients we want to target initially.
Would you say there are still a lot of holes in Unix?
Oh, yeah.
Oh, yeah.
Even the most current releases?
Oh, yeah.
So that opens up a lot of the Internet, things all over the world.
Do you hire your services out to other countries as well?
Sure.
Right now, you know, we've all got valid passports, and I don't see any reason why we wouldn't be able to work overseas.
You know, when we're working off-site, it's expenses at cost.
So if someone from an overseas corporation is interested, you know, we're listed in Houston directory assistance.
Now, let's give a hypothetical situation here.
Let's say that you have been hired by a certain company or institution to keep their computer system safe.
And you notice a hacker has successfully gotten in, and he got sort of like a Clifford Stoll situation on your hands.
How would you handle it?
Well, basically, with the hacker knowledge out there, and I will tell you that there are some extremely intelligent people out there that hack systems.
If this were to happen to one of our client's systems, we take the following procedures, contact the correct authorized people.
It's really system dependent of what we would do.
So first off, we'd like to say, because this has come up in a lot of interviews that we've done, is that we are not hacker trackers.
We're not informants now.
We're not going to go after hackers.
But I can tell you this now.
If someone does break into a system that we've secured, we will find them in two days and track them down and tell the proper authorities who they are.
So that's just a given.
But back to the point of this scenario, if someone did break into one of our systems, I'd make it extremely hard for them to do.
They must be a really motivated person because it's not going to be easy.
It's just not going to be easy.
Now, you mentioned tracking them down, though, and getting the proper authorities.
Now, don't you see that as rubbing some hackers the wrong way?
No, no, it doesn't.
You know, we're out here now to make money, okay?
This is what we feel that we can use our talents and our skills best out.
This is what we've been trained for the last 11 years, to do this.
And if someone's going to come around and try and break into one of our client's systems, you know, and cause us maybe to lose a contract with them,
well, we're going to have to step in and say, well, you know, we can find this person.
You know, it's just not going to be easy for them to break in, but if it does happen, we'll find them.
But wouldn't they be breaking in as a result of some sort of a security hole?
You know, possibly.
And that's the thing with the Unix platform, since we will be focusing on Unix platforms for the time being,
is that new holes are uncovered every day.
New holes are uncovered and reported every single day.
Unix is a very buggy system, and it's just not possible.
You know, tomorrow there could be a new hole that a hacker finds, and he'll keep it to himself for a year or so until somebody else comes across it or until it gets loose somewhere.
But, you know, these things we can't take into place.
You know, it's, like I said, system dependent.
But if there will be a new hole that someone gets a hold of and allows them access to one of our systems,
well, we're just going to have to have watchdog software out there that we're developing ourselves that will watch for intruders,
that will take note.
If John Doe normally logs in to his company computer during a certain time and does standard applications,
then we're going to have a watchdog system that will monitor John Doe's activity.
And if for some strange Wednesday night at 2 a.m., John Doe decides to log in and accesses the password file,
well, it's going to take a note of that.
And it's going to say, hey, system administrator, you need to check this guy out.
Is he really John Doe?
I see.
Do you want to encourage people to try and exploit the holes so that you can find all the security holes,
or are you trying to keep them from doing that?
Well, you know, I'm not going to encourage someone to exploit anything.
And, you know, do what it is that they want to do for their own personal reasons.
You know, we're trying to provide a service to corporate America,
both beneficial for us and beneficial to industry as a whole.
So, you know, the actions that others might take to do, you know, for whatever reasons they have,
you know, I'm not going to say, well, I'd like to see someone break into this network
so I can find out, oh, gee, there was a bug in that network.
That doesn't, you know, that's not a real ethical stance.
No, I'm just a little concerned about the way this would be viewed by some people
who would see you approaching this from one angle a few years ago
where you pretty much have the right to go wherever you want to go to find something.
You want to get that information.
And when confronted with someone perhaps a little younger than you doing the exact same thing,
would you treat them the same way that you yourself would have wanted to have been treated,
or have you become the establishment, so to say?
I don't think, you know, the chance of someone younger than ourselves
and less knowledgeable than ourselves, or even as knowledgeable or more knowledgeable,
but the fact of someone else getting into a system that we've secured,
I find, I'm going to find that real hard to believe that that's going to happen.
If it does happen, I welcome it, and I'd like to, you know,
have the chance to find out exactly what it is they did and how they did it,
but I don't see it as happening.
When we certify a system that's secure, it's going to be to the point to where we could not break into it.
And I think if someone from the Legion of Doom can sit and say,
well, I could not get into that system, I think that would probably...
But by saying that, you're also kind of maybe unintentionally issuing a challenge.
No one's going to know who our clients are.
That's strictly confidential information.
If you were running a big Fortune 500 company,
would you want the rest of the world to know that, well, our security was bad and we had to hire these guys?
That's confidential information.
No one's going to know who our clients are.
No one's going to be able to say, well, gee, I'm going to hack XYZ Corporation
because LOD said it's unhackable.
No one's going to have that information.
We're talking with Scott Chasen and Chris Goggins of the ComSec Computer Data Security.
Is that the proper name?
Data Security.
ComSec Data Security.
Former members of the Legion of Doom.
We are taking listener phone calls.
The telephone number is 212-279-3400.
If you want to ask them a couple of questions, please feel free to give us a call, 212-279-3400.
And the reaction, you say, has been mixed from people in the underground.
How would you say the press has treated this?
Well, the press has had a field day, of course, because there's a lot of leeway for hype.
People, you know, the story for the press isn't necessarily Legion of Doom goes corporate.
The press has been Legion of Doom.
And the company seemed to have taken a back seat.
And that's not quite what we envisioned.
But, you know, as far as we're concerned, for any new company, any kind of advertisement,
any kind of press that you can get is good because it's free advertising.
And a large portion of any company's expense is going to be budgeted towards advertising.
And we're, in a sense, getting free advertising.
You know, nothing's been overly negative.
Everybody seems to have an open mind.
Everybody's just waiting to see what we do next.
So, you know, I feel fairly positive about all the attention we've gotten.
All right.
Let's give some of our listeners a chance to come in here.
212-279-3400 is our telephone number.
Good evening.
You're on the air.
Yeah.
Good evening, everyone.
It seems that you were, like, interested in showing these people with such genius to create computers
and all these various systems that you could outwit them and outdo them.
And in a way, that's a wonderful achievement.
You know what I'm trying to say?
As long as you didn't do anything, shall we say, dishonest.
Now that you've shown them how you can invade their territories and how inferior their thinking is,
you, like, are saying, well, why don't you pay us or our talents and utilize our talents?
I myself complain about the getting rid of the garbage where I work because I think of Webberman,
what he did with Bob Dylan's lyrics, you know, that he showed how Dylan created and changed things and so forth.
So I take my hat off to you in a way, and I hope that you'll have success.
However, you know, apropos of your program, it's not just about the telephone and systems and outages and so forth, Emmanuel.
That you're really driving at is this sense of if there's such a thing as privacy or, you know,
anything that can be kept from other people.
And perhaps there is that area and perhaps not.
You know, perhaps we don't want to have our sexual behavior right in the spotlight of the world,
but in a better thinking society, maybe it would be perfectly permissible.
However, I will say this in ending, and that is that not everybody that works at WBAI
understands the concept of freedom of speech, which I thank you for allowing me to express.
And I do hope that in future programs we'll be able to explore the idea that dissent,
while it differs from what people believe, nevertheless is important for the very idea of human thought.
Thank you very much.
Okay, and thank you for that little speech there.
Our telephone number is 212-279-3400.
We have open lines.
Let's see who else is out there.
Good evening.
I wanted to ask you, what do you think about is a bleaching, ugly, darker skin, too?
Uh-huh.
Okay, let's try this one.
Good evening.
Hi, I have a technical question.
Maybe the Legion of Doom might be able to answer that.
I don't know if they know anything about Microsoft Word 5.5.
You guys want to tackle that?
It's a great program, but once you go by the manual, it'll teach you a lot.
I have the manual.
The manual?
Why don't you try reading it?
I am.
I am.
Oh, wait.
Wait, what kind of problem are you having?
I don't exactly fall into the field of computer security, but let's see if we can fail.
All right, listen, I'm sorry to bother you guys, but it's something to do with the setup program
and the setup disk that you put in, and when you put it in, it asks you a list of questions.
That's right.
Now, you're supposed to answer the questions as they come onto your terminal.
Did you insert the first disk in drive A?
Uh-huh.
You did.
Did you run setup?
I didn't do it yet, but I want to ask you if I can skip over a couple of those questions,
even blank.
You've got to go through the whole thing in order to fully configure it for your individual
system, sir.
Just like life itself.
It's easier to go follow the directions, and it'll help you out a lot more.
But what happens if I don't have an external screen or a printer?
I can't configure anything.
Are you telling us, sir, that you have a motherboard, a CPU, and a keyboard?
Right.
Well, if you have no monitor, how do you expect?
I have a monitor, but not an external monitor.
It's asking me questions about an external monitor and a printer, of which I don't have any.
The question is, no.
You have no external monitor.
You have no printer.
And you need to tell it that in a firm tone, that you do not have these things, and then
maybe it'll stop asking you those questions.
I'm sorry.
We're going to have to stop answering those questions now, because it doesn't really apply
to this program.
But maybe the program after this, the Personal Computer Show, they might have more information
on that.
Thanks for calling.
Let's go to another call.
Good evening.
Good evening to you.
I have a bit of a question.
Go ahead.
It is to you.
I don't know that I misheard you when you requested these men to explain their organization.
You said that hopefully people would not think that they are Iraqi terrorist organizations.
Well, it was a term used in light of all the media hype that's been going on over the
past year.
Not in the best tradition of the Pacific.
Uh-huh.
Well, insert whatever nationalist group you want to put in there in its place.
It's equally bad.
Well, let's say Martians.
It is not a terrorist organization.
That's good enough.
I'm sorry?
You just can say that it is not a terrorist organization without any.
Okay.
Well, we'll just leave it at that then.
One is mood.
Strike Iraqi from that phrase.
Or any, or any nationality, or any religious group, or any, would be better, and would be
in the better position of the Pacific Foundation.
Okay, so we will say that the Legion of Doom was not a terrorist group of any sort that represented
any nationalist or territorial interest.
Exactly.
Okay.
Thank you very much for pointing that out.
And it's good to have so many conscientious people out there.
Good evening.
You're on the air.
Go ahead.
Hello?
Are you waking up?
Okay.
Well, go back to sleep.
Good evening.
Yes.
Hi.
My question is about building maintenance and monitoring systems, you know, controls of
doors and controls of heating and all that.
I do that extensively.
I feel I have a good system.
I can't really stay on the phone.
So if you could touch on that a little bit.
I don't mean directly into a mainframe.
I mean into building control systems.
If you could talk for a minute, it would be great.
I have to hang up.
Okay.
I think maybe he wants to talk about some of the security problems.
Okay.
I think I might know what the man wants.
I'm a little hazy.
All right.
He's asking, he builds these maintenance systems to upkeep, I guess, air conditioning
and building security and stuff like that.
Sir, if your systems are not tied into any phone lines and they're only accessible in-house
by employees, your chances for any kind of breach of that security are slim, unless, of
course, you've got some disgruntled employee who decides the temperature ought to be 1,000
degrees.
That's something your clients will have to contend with, and I think you'll stay fairly
safe from that.
Well, two questions I have right off the bat.
First of all, why would any system allow you to do something that's obviously unreasonable,
like bring the temperature above, say, 90 degrees even, and B, what possible use is
it to have a system like that available through a dial-in phone line?
Well, a lot of them are, actually.
It's mainly because you can have two buildings, one with the central controller to control the
heat and security, et cetera, and then the other one with the actual office and the personnel
and the clerks that use the system.
That way, it gives them some kind of remote access so they can control the temperature and
everything else that corresponds with that for a remote location.
All right.
Let's go to another call.
Our phone number is 212-279-3400.
Good evening.
Turn down your radio, please.
Hello?
Anyone there?
Okay.
Let's go to the next call.
Good evening.
Yes.
I have a question for the experts.
Go ahead.
Okay.
I just recently bought a Sharp Wizard 64K hand computer, and I have a lot of important information
on it.
It has password protection.
How easy would it be if I lost it for somebody to get through the password?
Okay.
Are you trying to ask us how easy it would be for them to crack your password on your Sharp
64K handheld computer?
Yes.
How long is your password now, sir?
How many?
Two digits.
Two digits?
What's the maximum you can change it to?
I think up to eight.
That would be wise.
It is.
I see.
Well, how much longer?
I mean, you're saying they can hook up another computer to it, and it would just go through
all the characters?
Well, if someone had your computer in their hand, they could probably, if they really wanted
to, they'd take it apart.
And if you take those computers apart, you can act, the password is in the computer, you're
telling me.
Yes, it is.
It's in the computer, and if they really wanted to bypass it, they could, since it is handheld.
And if you did lose it, then there is a possibility that they could bypass it by all means.
So I suggest that if you carry this on your person...
Yes.
To use a longer password.
That's correct.
One other question, then.
Then you're saying that all computers in the world, that there is no way that you can give
a password that's not in the computer.
There's no such thing.
Obviously, I guess it has to be in the computer.
That's correct.
If you enter an invalid password, it's not going to let you onto the system.
That's the whole idea of passwords.
The whole idea of passwords...
Hello?
...passwords, so nobody else can access their accounts.
So if someone guesses, ask your password...
I don't know if it's my phone line or yours, but...
I think you're in a noisy location, so what we're going to do is disconnect you and let
them finish answering the questions.
Okay, I'll listen on the radio.
Okay.
Thank you for...
Oh...
I guess he's not going to make that last point.
Go ahead and finish your statement.
As I was saying, if the password try is incorrect, it's not going to let them log on to the
account.
That's the whole password scheme.
That's why passwords were invented.
A two-letter password, though, would be incredibly easy to crack.
It seems kind of pointless to even have one.
Something I would suggest to the gentleman is to try cracking it himself, pretend that he
doesn't notice, or even better still, forget your password and just try to remember it.
Things like that have happened to me, too.
Or another possibility would be, what if he really did forget his password?
Is there a way to contact the company and say, hey, I forgot my password.
What do I do with this useless hunk of metal?
And then you also have to take into consideration that if someone did find his machine and they
didn't want to go to the trouble of taking it apart, if they could call Sharp or whoever
makes it, manufactures it, and say, hey, I lost my password, how do I get back in?
Right.
Right.
Okay, let's try a couple more calls in the time we have left.
Good evening.
Yes, this is the Off the Hook Show.
It is.
Do I have a question?
Go ahead.
It's about the Unix system.
Okay.
I wonder if they use the password file to, do they know the codes for the password file,
how to break, and they get in as root access?
How do you break into a Unix system and get root access?
No, no, no, no.
When you break into this, is this the guy from this?
Yes, it is.
When you call in Unix, you know the Unix, there's a password file.
That's correct.
All right, do you, you know, know the code?
You know, it's encoded the password file next to the person's name.
If we know the algorithm to the DAS encryption.
Do you know that algorithm?
Is that how you break into the people's systems?
No, no, no.
To my knowledge, DES is unreversible.
I think maybe it is.
It's a one-way encryption, and you can't decrypt DES.
I think the NSA maybe can.
Maybe you should ask them.
Maybe a couple of Ruskies, but not in America.
So when you secure the systems, do you, like, change the encryption when people log in?
No, DES is the standard encryption for the United States.
We're not going to mess with that.
What we will do, though, is we'll suggest a shadow password, which entails exactly what this is, is that it hides the password file.
So nobody can see the encrypted password, so they can't try to encrypt and compare passwords or otherwise guess at passwords in the encrypted form.
So why don't you just encrypt when the person logs in?
Does that make a lot more sense?
Well, it is encrypted on the system.
It's not in clear text.
Basically, how hackers get in is they guess at passwords.
You know, you'd have a password, your name is John.
Most Johns use the password John as their password, which is not a good password.
In fact, in 2600, this issue, we published a program that looks through the dictionary.
Every Unix system has a dictionary file, and if somebody uses a word that is in the dictionary,
and there's tens of thousands of words in there, it will find it, and it will say what the word is.
It's very easy.
All right, let's go on to one more call.
Good evening.
Hi, how are you doing?
Okay.
I'd like to follow up on one of Emanuel's questions, because I think the answer was a bit incomplete.
In this program, one of the premises seems to have always been that information is free.
Your guests seem to be taking the position that people should be punished, put in jail, their lives ruined, et cetera,
for merely accessing information.
I'd like to know in what way they reconcile this with their own earlier activities and feelings about the freedom of that information.
Okay, and that will have to be the final comment.
Go ahead.
Okay, we don't condone hacking.
Information as being a free, basic, Chris, you want to take this one?
Yeah.
As far as, basically, the guy, you're saying that perhaps we might have a hypocritical stance from our past actions.
But, you know, there are times when the actions of certain hackers should be viewed in a more serious criminal manner.
Someone who looks around a system with a guest account is not, in my opinion, entitled to the same kind of prosecution
as someone who would physically kick down the door of a company, walk in, type on their terminal, and delete every single thing they have.
Right now, under current laws, this is viewed in the same manner.
I don't think it should be.
And, you know, in the future, I hope that things will change.
That's, you know, if someone was snooping around on our system with a guest account,
we wouldn't immediately go running to the federal authorities, but there wouldn't be a guest account there to begin with.
However, if someone, through some more malicious means or with more malicious intent, broke into a system,
that's the kind of person who doesn't, you know, first of all, it doesn't follow the kind of, the code of practice that we worked on ourselves,
and it's not the kind of thing that we would ever believe in.
And so, certainly, we'd see what kind of measures need to be taken against an individual like that.
Folks, we are out of time.
Sam, we've been speaking with Scott Chasen and Chris Goggins of the ComSec Data Security,
former members of the Legion of Doom, and I suppose if people want to get in touch with you, how can they do so?
They can give us a call at 713-721-6500 or mail us, and we're listed.
Okay.
Thanks so much for being with us, and keep us updated as to what goes on in the future.
Okay, well done.
Thank you.
And that concludes Off the Hook for this Wednesday night.
We'll be back again next Wednesday at 9 o'clock.
Stay tuned for the Personal Computer Show.
This is Emanuel Goldstein.
Take care.
The telephone keeps ringing, so I ripped it off the wall.
I cut myself while shaving.
Now I can't make a call.
It couldn't get much worse.
Thank you.
Thank you.
This is for clicking on the wall.
I don't know.
I can't be familiar with the maid.
I don't know.
Thank you.
I'll be back right now.
Thank you.
All right.
Thank you.
Thank you.
We will watch.
I'm so excited.
Amen.
Thank you.
I'm so excited.
Thank you.
I don't know.
Thank you.