STReport Headline News LATE BREAKING WORLD-WIDE NEWS Weekly Happenings about & affecting the Computer World

Hackers Launch New
Invasion Tool

LAS VEGAS (AP) - Computer security companies updated their virus-detection software Sunday after the in-your-face launch at a hackers convention of a new tool designed for stealth invasions of networks operated by Microsoft Windows.

Despite the rapid response, however, any defense against the hacking program may prove fleeting thanks to some aggressive tactics taken by the tool's authors, an irreverent group named Cult of the Dead Cow, or CDC.

The hacking tool, called"BO2K," can enable someone to gain control of a computer or network from a remote location. BO2K is an abbreviation for a slightly obscene variation of "Back Office," the name of a program in Microsoft's Office 2000 suite of business software.

The CDC and other hackers attending the seventh annual "DefCon" convention in Las Vegas charged that Microsoft has stubbornly refused to address a multitude of gaping security holes in Windows.

By exploiting those vulnerabilities, hackers hope to force the world's largest software company to repair them. And, raising the ante another notch, the CDC is also releasing the software code for BO2K _ inviting other programmers to create mutations that would frustrate efforts to immunize computers against attack.

But that vigilante-type "hactivism" was rejected by Microsoft and federal officials, including many who attended DefCon under cover _ at least until they were unmasked during the convention's popular "Spot the Fed" contest.

BO2K is actually an update to a hacking tool released at last year's DefCon hackers convention. The first tool targeted the Windows 95 and Windows 98 operating systems that run an overwhelming majority of the world's desktop computers.

Much to the delight of the nearly 1,000 anti-Microsoft enthusiasts who crammed into the BO2K launch Saturday, the new tool can also hijack control of network systems using Windows NT, a top program for running computer networks, as well as computers running on test versions of the as-yet unreleased Windows 2000.

``Our position is that Windows is a fundamentally broken product," said Death Veggie, the CDC's "minister of propaganda." Like nearly every hacker, Veggie only identifies himself by his online pseudonym, partly for effect and partly out of legal concerns. "Hopefully, this will force them to fix this thing."

The government-chartered Computer Emergency Response Team at Carnegie Mellon University in Pittsburgh is investigating B02K, but has not issued any advisory or warning.

The hacking tool "is one of several programs which, if installed on an organization's computers, can give control of the computers to outsiders with malicious intent," Jeffrey J. Carpenter, senior incident responder for the CERT, said Sunday. Because BO2K works with Windows NT, "intruders have the potential to gain control of more sensitive server machines."

By Sunday morning, leading computer security firms such as Symantec and Network Associates had already posted advisories and detection software for BO2K on their Web sites.

Microsoft had been blasting BO2K even before Saturday's highly theatrical presentation, which relied heavily on thumping industrial music, strobe lights and screaming _ a bizarre mutation of the dog and pony shows that often accompany a Microsoft product launch.

"I certainly categorize what they're trying to do as being malicious. This program they have created has absolutely no purpose except to damage users," said Jason Garms, lead product manager for Windows NT security, complaining that hackers behave as if the Internet operates under a different set of rules than the rest of the world.

"You can't walk down the street and pick up a rock and throw it through someone's window. You'd be arrested," said Garms. "But there are people on the Internet that would argue that it's good behavior because that window should have been stronger. In the real world you can't say 'You should have bulletproof glass on your windows."

### Net goes postal with online stamps

A sample envelope with preprinted Internet postage is printed out on a printer attached to a laptop computer logged onto Internet postage provider E-Stamp.com . (AP)

LOS ANGELES (AP) -- The U.S. Postal Service plans to allow customers to buy stamps over the Internet and print them directly onto envelopes and mailing labels in a campaign to increase sales among small businesses.
PC Postage marks the Postal Service's first big step into electronic commerce. The program is being tested by a select number of small businesses in California and the Washington, D.C., area. It could be available nationwide by the end of summer, Patricia Gibert, the agency's vice president for retail sales, said during a demonstration Wednesday.
Rather than individual consumers, the program initially targets an estimated 8 million small business and home office customers who find stamps inconvenient, but don't want to buy or rent a mail-metering machine. ''If we make mail easier, people will stick with it longer,'' Gibert said in an interview. ''We aren't trying to stop the tide of e-mail and it shouldn't be done, but ease of use is a big cost factor,'' she said. ''You've got to meet the customer where he is.''
Tests have been under way for more than a year. They are being conducted by E-Stamp Corp. of Palo Alto, Calif.; Stamps.com of Santa Monica, Calif.; and two makers of mechanical postage meters, Neopost Inc. of Hayward, Calif. and Stamford, Conn.-based Pitney Bowes Inc. The systems require customers to purchase stamps in advance using a credit card or debit card. Service fees are expected to run about 10%. Customers can purchase stamps for first-class, priority and express mail, and can use their own printer to create a postmark and bar code in the envelope's upper right-hand corner.
Typically, the software allows customers to do individual or mass mailings. The Web sites preserve a log of all mailings and a list of stamp prices. And as an option, companies provide digital scales that will weigh larger letters and tell the customer how much postage is needed.
''It's really been great. Now I'm not peeling and sticking stamps,'' said J. Wingate Greathouse, office manager at Bowles Kendrick & Lemanski Architects in San Francisco, one of the companies involved in the E-Stamp testing.
Wellington Wilson, whose Wellington E-Group is creating an online shopping mall, began testing the Stamps.com product in January. The system worked without a hitch in February, when he used it for a 500-letter mailing. ''The mere fact that I could just run the envelopes through the printer and fix the postage made it so convenient, the fact that I didn't have to go to the (post) office and buy $200 worth of stamps,'' he said. Final testing has focused on ensuring that the systems offered by each company are secure against hackers and counterfeiting, Gibert said.
So far, the 1,200 customers involved in testing have purchased more than $75,000 worth of stamps to send 46,000 pieces of mail. For now, at least, the system isn't suitable for big companies that send hundreds or thousands of pieces of mail per day. For large projects, metering machines are faster and more efficient. Though that could change if private companies create new software and printers. There are currently no plans to expand the PC Postage market beyond small businesses, Gibert said. ''Entrepreneurs being who they are and with the opportunity to take an idea and expand it, we can see products that might work for larger customers,'' she said.

AltaVista adds free ISP service

AltaVista’s next big move in the portal wars will be to offer Internet access. But unlike the ISP deals offered by such competitors as Yahoo! Inc. or Excite Inc., AltaVista will be giving the service away.

THE MULTI-FEATURED PORTAL SITE, which is in the midst of a rush to introduce new deals and features, will begin offering AltaVista-branded Internet service in the next few weeks, the company confirmed. AltaVista has announced several new features and services since the announced sale of a controlling interest in the company to CMGI, which owns stakes in a wide variety of Internet companies including Lycos Inc.

Portals Yahoo!, Excite, Lycos, Infoseek and Snap.com began offering conventional ISP service several months ago, but that’s not the only area where AltaVista is playing catch-up. The site recently announced it will offer a personalized home page, something pioneered by Yahoo! last year and quickly imitated by most other players. “All of the other portals have been offering these types of deals for a while now,” said analyst Bridget Leach of Giga Information Group. “With the renewed and reinvigorated AltaVista under CMGI, they’re going down the checklist of features, so as to be on par with what everyone else is offering.”

1stUp, founded late last year, aims to provide brand-name companies such as AltaVista with wholesale Internet connectivity and with software to display advertising banners. As with other free ISPs, the advertising is displayed as long as the user is connected, in a window that cannot be closed, and the ad revenues pay for the service. 1stUp believes its ad inventory will be attractive to advertisers because of the brand-name appeal of distribution partners like AltaVista.

“We will be announcing numerous other big-name customers soon, so we will be able to offer the buying power of not just a single brand name, but multiple brand names,” said Charles Katz, co-founder and CEO of 1stUp. “More advertising dollars are becoming available online, especially for the top brands, and the cost of connectivity is going down. As those curves cross, the economics of free ISPs work out perfectly.” The portal is 1stUp’s first distribution deal, but it hopes to work through retailers, computer manufacturers and other companies that want an Internet presence. AltaVista is in the midst of its third major reincarnation, after starting life as a search engine that was popular for its speedy and comprehensive search results, and later moving into the portal space by adding features such as news feeds and a subject-oriented directory.

Broward County Swamps
AT&T's Cable Plans

WASHINGTON (AP) - From the northwest to the southeast of the US, AT&T Corp. is beginning to experience some real frustration in its attempts to build its cable monopoly. Broward County, Fla., including the city of Fort Lauderdale, has rejected AT&T's and other cable operators' bids to keep their cable infrastructures free of competition.

The Broward County Commission late Monday in a 4-3 vote said that cable companies and their overlords, including AT&T and Time-Warner Inc., must offer open access to competing Internet service providers. The ruling runs counter to AT&T's claim in other jurisdictions, including Portland, Ore., and surrounding Multnomah County, that local jurisdictions cannot rule on cable competition matters, and that these local governments must bow to the federal policies of the Federal Communications Commission (FCC).

While the FCC has declined to regulate the cable industry, several local jurisdictions have ruled that competing ISPs must be able to offer high-speed access via existing cable networks. "Today's decision is clearly wrong on the law and bad public policy," said AT&T Vice President of Law and Government Affairs for Florida Kevin McNeely, in a statement. "It will have the unfortunate effect of discouraging investment in technology that would bring a choice of local telephone providers and high-speed Internet access services to the citizens of Broward County."

"As FCC Chairman (William) Kennard recently stated, the information superhighway will not work if 30,000 different localities each establish their own rules for Internet access," McNeely also said. "Consumers, not the government, should be the ones to choose what new technology becomes available." MediaOne is the local cable company in question in the Broward County case. Opponents of cable companies' plans to keep their networks closed to competing ISPs, or at least to set up access agreements according to their own terms, are led by the OpenNET consortium, which includes America Online Inc., US West Inc., and Qwest Communications International Inc.

These companies argue that a proprietary cable infrastructure denies local telephone companies the ability to offer high-speed cable access because the FCC currently prevents incumbent local exchange carriers (ILECs) from offering long distance voice or data service until they satisfy what they consider onerous regulatory terms established by the Telecommunications Act of 1996. Companies like AOL also argue that consumers who want high-speed cable access will be forced to use ISPs that are owned by the cable operators, which means that if customers of other ISPs want to keep their accounts, they will have to pay for two ISPs. There are about five bills in Congress designed to address the problem, though it is unclear how many of them will make any substantial progress in the 106th Congress.

UN shrinks from "tax
the net" stance

WASHINGTON (AP) - An apparent United Nations recommendation that world governments levy a tax on Internet usage to help developing countries bolster their Internet access has drawn a predictably heated response from federal legislators, but UN officials told Newsbytes that they did not endorse the recommendation in question.

Although UN officials concede that the recently published "Human Development Report 1999" contains a recommendation that governments institute a tax on Internet usage, the United Nations Development Program (UNDP), which sponsored the report, does not endorse the report's views. "The UNDP does not advocate any form of global tax," Normand Lauzon Assistant Administrator and Director for the UNDP's Bureau for Resources and External Affairs told Newsbytes. "The UNDP has no power to (institute a tax) and has no desire to do so."

The report contains a disclaimer noting that views expressed within its pages do not necessarily reflect those of the UN and, in the case of the taxation recommendation, that definitely is the case, Lauzon said. House Majority Leader Dick Armey, R-Texas, slammed the idea of a new Internet tax in a letter responding to the report.

"Every time you turn around, it seems there is another agency or bureaucracy looking to get its greedy mitts on the Internet through new taxes. This time, it's the United Nations," Armey wrote.

"The reason we put the letter out is that we want to make it clear that anytime someone comes up with a scheme to tax the Internet, we are going to get in their way," Armey staffer Richard Diamond said. "There is nothing more outrageous than some un-elected bureaucracy in New York taxing the Internet." Authors of the UN report were un-available for comment.

Back Orifice CDs infected with CIH virus

Cult of the Dead Cow confirms official CD-ROMs were infected with CIH

“There must have been a virus on the duplicating machine and we didn’t know about it,” cDc member DilDog said. “This incident is unfortunate and we are doing what we can do to rectify it. We can’t apologize enough.” “We screwed up,” he said. cDc, which distributed 32 official CD-ROM versions of BO2K at the DEF CON hacking convention last weekend, had previously denied that its CD-ROMs were infected with Win95.CIH, a virus that reformats hard drives and, on some machines, can erase the BIOS information that the computer needs to operate.

Although an embarrassing publicity snafu for the high-profile hacking group, the CIH incident doesn’t affect cDc’s method for mass distribution of BO2K, the Web. Like its predecessor, Back Orifice, BO2K was released on the Web on Wednesday, where it will be available for free download. PC Week Labs senior analyst Jim Rapoza, who downloaded and tested the Web-version of BO2K, confirmed that the Web version is virus free. DilDog also confirmed that the Web version of the program is “absolutely clean.”

DilDog said cDc thought that only pirated copies of BO2K, burned and distributed at DEF CON within 45 minutes of the hacking tool’s splashy debut, were infected with CIH. However, cDc changed its tuned after several anti-virus firms and ZDNN reported finding CIH on official CD-ROMs — confirming that the executable files in the CD-ROM were infected. “We would like to thank various individuals profusely for pointing this out to us,” DilDog said. cDc member Count Zero, who gave out a few of its CIH-infected BO2K CD-ROM with “Virus Free” written on the case, said the incident was not malicious. “We are not perfect ... It was human error. Our error. We weren’t trying to do anything malicious,” he said.

Back to Index