RISKS@KL.SRI.COM (RISKS FORUM, Peter G. Neumann -- Coordinator) (01/13/88)
RISKS-LIST: RISKS-FORUM Digest Tuesday, 12 January 1988 Volume 6 : Issue 8
FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator
Contents:
Missent Missives (Martin Ewing, Leonard B. Bliss)
Touch-Tone Risks (Andrew Vaught)
American Express Computer Problem 2 (Frank Wales)
Re: PCs die of New Year Cerebration (Scott Nelson)
UK Logic Bomb Case is Thrown Out (Geoff Lane)
SSN abuse warned about long ago (Richard Brown)
SSN Required Disclosures -- library social security privacy (Steve Cisler)
The RISKS Forum is moderated. Contributions should be relevant, sound, in good
taste, objective, coherent, concise, nonrepetitious. Diversity is welcome.
Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM.
> > > > > > > > > PLEASE LIST SUBJECT in SUBJECT: LINE. < < < < < < < < <
For Vol i issue j, FTP SRI.COM, CD STRIPE:<RISKS>, GET RISKS-i.j.
Volume summaries in (i, max j) = (1,46),(2,57),(3,92),(4,97),(5,85).
----------------------------------------------------------------------
Date: Tue, 12 Jan 88 15:05:39 PST
From: msesys@DEImos.Caltech.Edu (Martin Ewing)
Subject: Missent Missives
Telex service does give you a more-or-less positive feedback as to whom you've
been connected to. It's called the "answerback code", which is sent at the
initiation of a connection and whenever you (the sender) transmit a WRU (who
are you) control character. Each machine is give a supposedly unique (and
usually mnemonic) code when it is installed; it has a length of 8 characters
or so.
You might think a campaign manager would alert to the Washington newspaper's
answerback, but it's all too easy to overlook the code until after the message
is sent.
Telex is an odd medium, slow and fundamentally two-way, but it
is almost always used in a one-way unattended receiver mode.
Martin Ewing, Caltech
[It used to be a relatively easy matter to break off a few tynes on
your answer-back drum, or indeed install a different one, thus being
able to masquerade as someone else. Perhaps it is harder now?
Somehow I doubt it. PGN]
------------------------------
Date: Tue, 12 Jan 88 10:46:11 est
From: ecsvax!blissl@mcnc.org (Leonard B. Bliss)
Subject: Missent Missives
Joe Morris asks, concerning misdelivery of E-mail due to human error,
"What feedback mechanisms are (should) there be to prevent this kind
of misdelivery for electronic mail?" I suggest that the answer to this
question is, "None!" There comes a point where human beings must be made
to accept the consequences of their actions and something akin to not
noticing that 202 (D.C. area code) is not equal to 319 (Iowa area code) is
decidedly one of those times. While machines make our work faster, easier,
and more comfortable, there is probably a limit to the extent that they
should protect us from our own stupidity. Certainly, the misaddressing of
E-mail described by Joe has passed that limit. However, it would be
interesting for us to attempt to pin-point precisely (or at least
approximately) where that limit is. Any ideas out there?
Len Bliss, Appalachian State University, College of Education, Boone, NC 28608
[One widely used notion is that of REDUNDANCY -- including check sums.
The notion that anyone can call your home (10 digits) and with another
single digit can (1) read your answering machine messages, (2) turn on
your oven, (3) turn your burglar alarm on or off, (4) feed the dog, ...
is somewhat hair-raising. One way of making unlisted numbers much
harder to find by sequential dialing experiments would be to use the
European technique of variable-length phone numbers. You want a
difficult number? Get one with 20 digits. It would also cut down
on random wrong numbers. PGN]
------------------------------
Date: Tue, 12 Jan 88 15:46:42 PLT
From: Andrew Vaught <29284843%WSUVM1.BITNET@CUNYVM.CUNY.EDU>
Subject: Touch-Tone Risks
Washington State University, like several other universities in the
area is currently planning on implementing a registration system based
on touch tone phones. The student dials the computer, and when connected
"dials" his/her ID number, followed by a five-digit number associated with
specific classes. The computer will either sign a person up, or inform the
caller that the class is full.
The ID numbers are eight digits long, which would give some protection
against someone using someone else's number. The only problem is that on
the local IBM mainframe (under VM/CMS), student userid's are the ID
numbers, and there are some pretty huge NAMES files floating around.
The potential for abuse is there, especially considering that one could
use dial-out modems on the system.....
Andy
------------------------------
From: Frank Wales <mcvax!zen.co.uk!frank@uunet.UU.NET>
Date: Mon, 11 Jan 88 14:25:31 GMT
Subject: American Express Computer Problem 2
After my submission the other week about American Express losing my PIN,
I just thought you might like to know that things don't appear to have
ended there. I used the card to withdraw some cash shortly afterwards
while on holiday in Scotland, and have received two (so far) notifications of
intent to debit the requisite amount from my bank account.
I called Customer Service and spoke to a Representative who assured me
that I would only be debited once; we'll see. A few questions revealed
that: this duplication had been happening to many Cardmembers using the
Express Cash service; that he didn't think there was a link to those who
had recently lost their PINs (although it hadn't occured to him); and
that he seemed unsure about whether this would be the last problem I
would encounter.
I'm sure all this malarkey is doing Amex's reputation no end of bad;
I'll let you know of any future developments.
Frank Wales, Development Engineer, [frank@zen.uucp<->mcvax!zen.co.uk!frank]
Zengrange Ltd., Greenfield Rd., Leeds, ENGLAND, LS9 8DB. (+44) 532 489048 x220
------------------------------
Date: Tue, 12 Jan 88 08:43:05 mst
From: decwrl!esunix!nelson@ucbvax.Berkeley.EDU (Scott Nelson)
Subject: Re: PCs die of New Year Cerebration [Risks 6.5]
A guy I used to work with here who previously worked at Sperry-Univac (now
UniSys) claimed to have inserted a good joke into one of their intelligent
terminals buried deep in the microcode where no one is likely to accidentally
find it. I don't know all of the details about the intelligent terminal, but
it could have had PC-compatibility as one of its intelligent features.
Anyway, when the terminal is first powered on, it checks to see if the current
year according to the battery-powered clock is different from the one saved
the last time it was turned off. If so, it displays a New Year's message and
plays "Auld Lang Syne" for about a minute using the tone generator normally
reserved for the bell. It is then supposed to work normally for the rest of
the year. He said he gets a good laugh every new year just thinking about it.
That company does start with "S" as the first article mentioned (at least it
did when it sold the terminal). I suppose there is a chance that this
"harmless prank" could become not so harmless after a few years.
Oh, and by the way, this guy now works for the other "S" company
mentioned above. Just a thought...
Scott R. Nelson
Evans & Sutherland Computer Corporation
UUCP Address: {decvax,ucbvax,ihnp4,allegra}!decwrl!esunix!nelson
Alternates: ihnp4!utah-cs!esunix!nelson usna!esunix!nelson
------------------------------
Date: Tue, 12 Jan 88 11:34:11 GMT
From: "Geoff. Lane. Phone UK-061 275 6051" <ZZASSGL@CMS.UMRCC.AC.UK>
Subject: UK Logic Bomb Case is Thrown Out
The following appeared in Datalink, dated Monday, January 11,1988.
James McMahon, the contract systems programmer accused of planting
"logic bombs" in his client's computer systems, has been cleared of
all charges.
McMahon walked free from Isleworth Crown Court, London, late last
month after the presiding judge Derek Holden accepted a
mid-trial motion that the evidence against McMahon was inconsistent,
incomplete and laking in reliability.
The ruling, which focused on print-out and disk exhibits, promises to
be a watershed in the history of computer law, influencing the
validity of such admissions in future cases.
The trial was billed as the UK's first "logic bomb" case, with McMahon
accused of planting unauthorised code in the DEC PDP 11 system
software of air freight forwarder Pandair Freight. The prosection
claimed that one such "lofic bomb" locked terminals at Pandair's
Heston office, near Heathrow, and a second was set to wipe the memory
of the company's Birmingham computer.
McMahon's motive was either financial gain or revenge after losing a
50,000 pound contract with Pandair, the prosecution said.
The judge ruled that the evidence wasn't solid enough and instructed
the jury to pronounce McMahon not quilty. A relieved McMahon told
Datalink: "I have lost much more than Pandair ever did."
McMahon, who was referred to during the case as a Posche or
Lamborghini driving philanderer, says he bears no resentment. His only
gripe is that he lost a major contract worth 40,000 pounds with the
Stock Exchange after police informed directors there that there was a
case pending.
McMahon has now returened full-time to DEC system consultancy in the
City.
In a second article in the same paper the following appeared...
Eighteen months of bing labelled a "logic bomber" finally ended for
system programmer James McMahon late last month.
McMahon was found not quilty of planting three so-called logic bombs
in the screen handling module of his client's DEC PDP 11 system
software.
The client, air freight forwarder Pandair, employed him on a freelance
basic to patch its system software and install or tune its operating
system, in this case the RSX 11 M+ operating system.
As well as maintaining his innocence throughout, McMahon is adamant
that the code that constituted the alleged bombs could never have
produced the effect the prosecution claimed. In short he claims he was
framed, that the code was written to discredit him.
As his barrister, Colin Nicholls, QC, put it in court: "The
prosecution evidence is partial, deceptive and manufactured. It smells
of dishonesty and contrivance."
The judge thought this submission well-founded, agreeing that there
were areas of unsatisfactory and missing evidence.
First, the original disks containing the supposed bomb were not taken
into police custody immediately after the suspected sabotage, but left
in the Pandair computer room.
The Pandair programmer who produced the printout of file directories
and source listings from the disks had sufficient skills in Macro
Assembler to insert the bombs the judge said.
Further the Pandair development disk went missing shortly after the
alleged crime.
"There is doubt over who produced the printout and which disks it came
from," he said.
And the motive for framing McMahon was there, claimed Nicholls:
jealousy over a shared lover and envy over McMahon's expensive
lifestyle.
However, after five weeks the judge was unwilling for the case to
continue with such gaps and doubts over the evidence. "we need to take
a particularly robust view of evidence in such a complex technical
case," he said.
The relief on the faces of the 12 men and women of the jury as they
were dismissed testified to that.
Geoff Lane, UMRCC
------------------------------
Date: Sat, 9 Jan 88 23:06:24 CST
From: Richard Brown <richard%a.cs.okstate.edu@RELAY.CS.NET>
Subject: SSN abuse warned about long ago
The abuse of the SSN was forseen long ago by none other than then-FBI-
director J. Edgar Hoover. His warning was against two things that would
reduce U.S.A. to a Police State: a national identification card, and a
national police force. His warning was heard loudly enough that for many
years the SSN card that you recieved from the government had a notice on the
back "this card is not legal for identification purposes."
I recently tried an experiment: I tried to go for one month without giving
my SSN to anyone. I found it impossible to manitain a reasonably civilized
life-style under that circumstance. For example: I could not write a
check, because it has my driver's license number on it which is, guess what?
I could not get a post-office box: positive ID (driver's license or state ID
issued by Department of Motor Vehicles, using SSN) AND current AND former
street address required. I could not use a credit card (BTW- this is alledged
to be tracked by NCIC and IRS. Cannot verify how much access is required
for the NCIC version of this). Could not enroll in college. |Financial Aid?-
HAH!!!! Could not get utilities connected at my new appartment. etc.
It is getting scary, Folks. Big Brother is here!
ps My Sysop commented on how much time I've been spending in net.mail lately...
--- Richard Brown, Oklahoma State University richard@a.cs.okstate.edu
------------------------------
From: well!sac@lll-crg.llnl.gov (Steve Cisler)
Subject: SSN Required Disclosures -- library social security privacy
Date: 7 Jan 88 14:00:43 GMT
I work in a public library, and I can assure comp.risks readers that most
libraries and librarians are very conscious of the privacy issue when it
comes to records about library users.
The best example is how our automated circulation systems are designed to
work. We will be using CLSI, Inc., the largest vendor to libraries, and I
think they are a good example of the care taken to protect the rights of a
book borrower's privacy. When you check out a book a link is established
between the barcode number on your library card and the barcode in the
borrowed item. As soon as you bring the book back, that link is broken and
no record of the transaction is archived. You can opt not to even be able
to see the current unbroken links unless items are overdue.
This means that no one in the library or legal or mental health system can
get a profile of your reading habits from checking old records. There are
just not any--except overdue items, and they are kept until you pay up and
clear your record.
That is reassuring, but I am troubled that some libraries ask for SSN as a
unique id before they issue a library card. Our committee on registering
library users quickly decided against this, again because of privacy matters.
I would urge any of you who use a library to inquire about this and post some
responses here. Our unique id will be first letter of first name, first four
letters of last name, month (1-9,O,N,D) and two digits of the year. Mine
would be SCISL042. There is some way they handle all the John Smith in one
big area, but this works quite well for most cities and counties.
------------------------------
End of RISKS-FORUM Digest
************************
-------