of University Bridgeport Department of Computer Science and Engineering Ethical Issues in Computing Memo #7 Ethics Online
What's new? Internet enhances and improves communication Problematic Behavior o Disruption of the Internet (hacking) o New versions of familiar crimes (e.g. credit card extortion and cyberstalking) o Violations of netiquette (social conventions suggest appropriate online behavior)
Special features of Internet communication o Global many-to-many scope o Anonymity o Reproducibility
Ethical Issues in Computing Notes on Hacking by Prof. Edward Gehringer, NCSU
Justifications for hacking. o All information should be free, and if it were free, there would be no need for intellectual property and security. An economist would say that by decreeing the price of information to be 0, you minimize the supply. o Break-ins illustrate security problems and cause them to be fixed. Steven Gold and Robert Schifreen penetrated British Telecom's Prestel system.--> o If the hackers wanted the security problems to be fixed, then why don't they try to get the problems fixed immediately? o This argument is like saying that vigilantes who tried to break into houses would be doing a neighborhood a service. Hackers do cause security modifications to be made, but at some expense, which would not be necessary if they didn't break in. E.g., if cars are being stolen frequently, locking them isn't good enough; you need burglar alarms. o There are other ways to expose security flaws, "tiger teams," for example. Hackers are doing no harm; they are just learning about how computer systems operate. o Even slowing down a system slightly could be critical in some cases. E.g., suppose it is being used to match organ donors with recipients and it fails to find a match soon enough. Hackers break into systems to watch for abuse and hold "Big Brother" at bay.
The Craig Neidorf case.
Background. o Neidorf was a pre-law student at the University of Missouri. o At 16, he and a childhood friend started an electronic newsletter called Phrack. o Some of the information in the newsletter could be useful to someone trying to gain access to a computer system or free use of telecommunication lines. o Law enforcement saw it as a potential breeding ground for computer criminals. The investigation. The charges: The government claimed that the E911 information could allow hackers to o illegally manipulate the 911 computer system in order to disrupt or halt service. o They claimed that Neidorf and his contributors were breaking into computer systems to steal documents and then publish them. o Evidence included- The E911 text file. Hacker tutorials published in Issue 22. A Trojan horse login program. A password-cracking program. E-mail between Neidorf and the contributor who stole the E911 file.
The defense. o The newsletter was aimed at the free exchange of information. o Publication is protected by the First Amendment. o Cross-examination revealed that most or all of the information that Neidorf had publi shed was in the public domain. The government decided to drop charges, but the case cost Neidorf $100,000. Is it a free-speech case? o Should electronic media be accorded less protection than print media with respect to free speech? o The material was stolen from BellSouth,though it did not bear a copyright notice. o T he judge said that the First Amendment can't be used to protect otherwise criminal conduct just because it includes speech.
2 A three-pronged approach to hacking.
Revise existing laws. Build and run more secure systems.
Ethical Issues in Computing Notes on Viruses, Worms on Trojan Horses by Prof. Edward Gehringer, NCSU
Types of attackers o Virus a program that incorporates copies of itself into other programs. o Worm a program that invades a computer and disables it. o Bacterium a program that replicates itself and feeds off the host system by eating up processor time and memory. o Trojan horse a program that performs some apparently useful function, while containing hidden code that performs a usually malicious action. Examples of attack o In the middle 1970s, a network of computers in a Silicon Valley res. ctr. was taken over by a program that loaded itself onto an idle workstation, disabled the keyboard, drew random pictures on the screen, and monitored the network for other idle workstations to invade. The network had to be shut down to restore normal operation. o In early September 1986, an unauthorized user logged on to a large number of computer systems in SF area, including 9 univs., 15 cos., 9 ARPANet sites, and 3 gov't. labs. First broke into a mail gateway system that had a guest acct. w/pw. guest. Then became a superuser <= /usr/spool/at was unprotected Easy to trick OS into executing privileged commands by storing them in that directory. Then he could assume identity of anyone in system. Then went through .rlogin files, etc. There were lots of them <= people wanted to use rcp to copy files. Left behind a recompiled login program so he could log in more easily later. He didn't do any damage at all. A Trojan horse (useful fct.: login). o In December '87, a Christmas greeting (CHRISTMA EXEC) was written by a programmer in Germany. Picture of Xmas tree w/"Holiday Greetings" superimposed on it. It used the NAMES and NETLOG files on VM/CMS systems to re-send itself to other users that the recipient had corresponded w/. NAMES file contains abbreviations for you people send mail to frequently. NETLOG contains a log of people from whom you have received or sent messages.
o
o
After awhile, network links were carrying more CHRISTMA EXECs than anything else. Relied on ability to send an unsolicited executable file thru the mail, so it couldn't happen on the Internet. "Browsing this file is no fun at all--just type Christmas." Users assumed they could execute it and then stop it if they didn't like it. But it wouldn't stop unless the computer was turned off, which caused mail & other open files to be lost. A bacterium. For 2 mos. in the fall of '87, a program quietly incorporated code into programs on PCs at Hebrew U. Was discovered and dismantled by a student Yuval Rakavy, who noticed that certain library programs were growing longer. Discovered that on certain Fridays the 13th, a computer running it would slow down by 80%. On Friday, 5/13/88, 40th anniv. of last date that Palestine was recog. as a separate pol. entity, prog. would delete all files. He wrote a program to look for copies & delete them, but couldn't be sure he got them all. A virus. In June 1995, a program was posted on the Internet and various bulletin boards purporting to be an update to PKZIP.
, PKZ300.ZIP. The result of executing these files on a workstation is a deleted hard drive. A Trojan horse. Other malicious viruses: DaVinci Systems in 1992 shipped demonstration diskettes with the Michelangelo virus. Michalengelo virus was widely publicized on radio & TV. On Mar. 6, 1992, the 400th? anniversary of Michelangelo's birthday, it was to erase hard disks. Symantec & other cos. produced software to protect against it. Symantec gave away 250K copies of a program to protect against it. <= widespread protection, it hit only 10K computers worldwide. One was So. Cal.-based Save the Whales, which lost membership list & a newsletter that was about to go out. U-M in 1993 sold 400 Macintoshes infected with the nVIR virus. On a Mac, a disk can be infected just by being inserted. You don't need to run any program! On a PC, you need to at least boot from the diskette. A recent virus infects Microsoft Word files. Read an infected Word document, & it infects your Word macros.
o
o o
o
It changes files into templates, which can be awkward to work with or transfer. Good Times virus hoax. Said that if you read it, your hard drive will be erased. Viruses in detail. Most viruses contain a marker that enables them to recognize copies of themselves. How does this help prevent detection? It keeps files from growing "too" large. The destructive acts come later. Most viruses attach selves to object files to prevent detection. Could read source code. But in case of mas virus, msg. discouraged users from doing so. Trojan horse could actually be inserted by a compiler. Then you could never find it by reading source. How 'bout by reading compiler source? Well, if compiler compiled self ... Protection from viruses: Virtual memory, which limits a program to a particular address space. Is really instance of principle of least privilege: restrict set of accessible objs. to min. that prog. needs to perf. its fct. VM can prevent some viruses, but not all <= certain portions of OS must be accessible t...