CRYPT NEWSLETTER 51 September - October 1998 Editor: George Smith, Ph.D. INTERNET: 70743.1711@compuserve.com crypt@sun.soci.niu.edu http://www.soci.niu.edu/~crypt Mail to: Crypt Newsletter 1635 Wagner St. Pasadena, CA 91106 ph: 626-568-1748 Crypt Newsletter articles may not be copied or reproduced in or on other media, on CD-ROM collections of data, or offered - in part or in toto - as part of any database, data survey, information or research service without prior consent of the editor. Rates based on word count are reasonable. Queries by e-mail are welcome. Contents: Crypt Newsletter #51 THIS ISSUE NEWS The Next World War will be fought with hoaxes What's new in world paranoia! Arthur Money: The Pentagon's new misinformation warrior The right way, the wrong way, the DoD way -- another in a continuing series How not to use the Internet as a propaganda tool Own a dangerous weapon -- a book! "Cybergypsies" slated for 1999 publication LETTERS SECTION: Iraqi printer virus hoax spotted in France THE NEXT WORLD WAR WILL BE FOUGHT WITH VIRUS HOAXES Famous last words: "In this new world, the soldier will be the young geek in uniform who can insert a virus into Teheran's electricity supply to plunge the city into darkness." -- James Adams, "The Next World War" === United Press International journalist James Adams' new book, "The Next World War," is a priceless example of how mainstream reporters continue to propagate old myths and hoaxes about information warfare. Adams recirculates the hoary tale of the Gulf War printer virus hoax in his book on the future of combat. If true, Crypt Newsletter supposes future combat will be mighty cheap, being fought primarily with dueling virus hoaxes and other info-war myths. This hoax's many permutations revolve around the central idea that the NSA developed a computer virus for use in the Gulf War, a virus that was used to disable the enemy's air defense system. Supposedly secreted in a microchip in a printer destined for Iraq, the virus was supposed to somehow emerge from the printer and bushwhack Iraqi air defense computers hooked to the same network. This was the result of a bald-faced April Fool's story that appeared in Infoworld magazine, subsequently taken seriously and presented as such by US News and World Report in "Triumph Without Victory," the latter publication's book on the Gulf War. A quick look to Adams' footnotes in the back of "The Next World War" reveals the poisoned section of "Triumph Without Victory" as his source. The Infoworld joke told of a computer virus smuggled into Iraq embedded in the hardware of computer printers. It was designed by the National Security Agency and it disabled Iraqi air defense computers by devouring the "windows" opened on computer screens. All these features were repeated a little too closely -- make that exactly -- for comfort in the U.S. News and World Report book. Since then, US News and others have reported sources, always anonymous, in the Pentagon repeating the tale, a fairly obvious case of "officials" who have taken their information from gossip that evolved from the original joke. "The Next World War" is just another in a long line of examples sprinkled through the mainstream media and other seemingly authoritative sources that have been taken in by this joke. Indeed, the Gulf War virus hoax is an almost inescapable component of computer lore -- the operative word being _lore_. Rob Rosenberger of Virus Myths comments, "Too bad [Adams] didn't do more research . . . [he] gives the story an interesting twist. The virus didn't get a chance to do its job because the U.S. Air Force accidentally bombed the building where Iraq stored the printers!" The 'Gulf War printer virus' story carries no credibility, no matter how highly placed the source" or whatever mutation it appears in," added Rosenberger. However, the Gulf War virus hoax isn't the only virtual Piltdown Man to appear in "The Next World War." Adams also bites on the chupacabras of info-war, the electromagnetic pulse gun built from Radio Shack parts. In 1996, Forbes ASAP magazine interviewed a crew of hackers who insisted an electromagnetic pulse gun -- a kind of electric ray that could be used to destroy PCs from afar -- could be built from Radio Shack parts and car batteries. In the story, entitled "Hack Attack," the Forbes reporter queries the "dangerous ex-hackers" about electromagnetic pulse guns. In response they spin a fantastic tale of its use -- again, against Iraq. [Part of this interview appears in Adams' "The Next World War."] A section of the original from Forbes ASAP is digested here: Forbes writer: Have you ever heard of a device that directs magnetic signals at hard disks and can scramble the data? Dangerous ex-hackers, in unison: Yes! A HERF [high energy radio frequency] gun. Dangerous ex-hacker A: This is my nightmare. $300: a rucksack full of car batteries, a microcapacitor and a directional antenna and I could point it at Oracle . . . You could park it in a car and walk away. It's a $300 poor man's nuke . . . Dangerous ex-hacker A: There are only three or four people who know how to build them, and they're really tight lipped . . . We used these in the Persian Gulf. We cooked the radar installation. In other parts of the article the hackers comment that there are a lot of "snake oil salesmen" in the computer security business. "The Next World War's" mention of the electromagnetic pulse gun chupacabras is fairly characteristic of the literature on the subject. Claims are made of a mysterious technology capable of doing bad deeds to computer networks. The weapons are in the hands of hackers, criminals, terrorists, or shadowy Russian scientists -- never sources of much credibility or ones that can be easily located. No examples are ever produced. No incidents of computer damage by electromagnetic pulse gun are ever provided that can be independently verified. "The Next World War" is a good example of the problem faced by the average reader with little experience in the area of discussion. Simply, the layman has a great deal of difficulty distinguishing between hoaxes and reality, particularly once such tales have become embedded in sources traditionally taken to be "authoritative." ============= Notes: In the October issue of WIRED magazine, an editorial sleuth writes breathlessly of James Adams' _top secret_ band of "intelligence" agents and info-war experts enigmatically called "The Group." One assumes "The Group" meets for discussions of techno-myths and computer virus ghost stories. In the past Crypt has also wryly noted WIRED magazine's penchant for profiling an assortment of utterly fascinating kooks: assorted Nikola Tesla freaks and one John Alexander whose devotion to crystal ball-gazing, i.e., "remote viewing," as a means of gathering military intelligence and fondness for the telekinetic bending of spoons is well known to newsletter readers. But not WIRED reporters. No truth to the rumor Lance Henrikson, aka Frank Black, was recently spotted attending a meeting of "The Group" at Tyson's Corner Center, Tyson's Corner, Virginia. SO WHAT ELSE IS NEW IN WORLD COLLECTIVE PARANOIA? Arabs, Russian "intelligence" agencies, suspect the CIA will use the Internet for subversion. In light of the current newsletter's comment on James Adams' "The Next World War," this next piece is a similar headache. The CIA's Foreign Broadcast Information Service yielded a short piece entitled "Report on CIA Plan for 'Information War' Via Internet" in August, translated from the Kuwait Al-Ra'y al-'Amm and written by the news organization's Moscow correspondent. "A report broadcast by the Russian intelligence agencies has revealed that the United States is bracing itself for an information war via the Internet with a view to changing the world political map. According to this report, the CIA views the Internet as an efficient intelligence weapon and the US Congress has recommended the US military intelligence to prepare a program for using the Internet for special purposes," writes the Al-Ra'y al-'Amm reporter. "According to the [Russian] report, it is expected that misleading information, both voice and picture, will be disseminated via the Internet through which Washington can fabricate social and political developments in other countries when necessary and as it deems fit. "In accordance with the intelligence theory, dazzling results can be achieved without having to resort to political pressure or military intervention in any area in the world where the United States thinks its interests are in jeopardy. "Under this plan, experts on information war will fabricate details which will undermine the foundations of any country, and the impact will be greater than that of a military confrontation or a political campaign. The country facing this information onslaught will have to fight an invisible enemy. "The Pentagon does not conceal that it is preparing this weapon to fight counties hostile to the US interests, like Iraq and North Korea. Washington can also use this weapon to execute certain operations in the former Soviet Union and Russia, including the expansion of the NATO to include Ukraine and the Baltic republics, or to serve its political and economic interests in important areas, like the Caspian Sea and the Caucasus. "What confirms the White House's seriousness about resorting to the information war is the fact that the US Congress allocated for the US intelligence agencies in 1999 a special provision in the budget to cover the expenses of using the Internet in the information war. US intelligence leaders are giving much attention to providing the necessary staffing to the information battle department. The number of people hired for this department, which was established a year and a half ago, is more than 100 people." ============ Notes: "The result of using the Internet or cyberspace to disseminate misinformation is not clear and may backfire." -- Ronald Elliot, former member of the Military Intelligence Board, writing in Federal Computer Week, August 1998 Back in October of 1996, Crypt Newsletter wrote about the military's idea of using the Internet in such a manner. The buzz-term invented by Air Force intelligence experts to describe it was "fictive environment." Reprinted from Crypt Newsletter 36: Coined by infowar kooks at the Air Force College of Aerospace Doctrine at Maxwell Air Force Base in Alabama, a "fictive environment" is one created when the U.S. military spams a bogus electronic press (or a radio or TV broadcast) release on Saddam Hussein kissing a pig into, say, the Iraqi communications network. This used to be called psychological operations but information warfare kooks have cleverly renamed it "fictive environment," perhaps to avoid being downsized when the psy-ops budget is cut. Of course, some in . . . [the] U.S. military believe such a stunt would discredit enemy leaders in the eyes of their troops, causing foreign soldiers to march to our side . . . or at least be gripped by indecision. The U.S., say [the same intelligence "experts"], is immune to a "fictive environment" since we have an open society and no one ever gets taken in by bogus news stories delivered via computer networks or television broadcast. The skeptical reader is forgiven for wondering what planet the intelligence experts who coined the term "fictive environment" have been living on. ARTHUR MONEY: DOD'S NEW MISINFORMATION WARRIOR Department of Defense's new info-war czar, Arthur Money, embedded yet another techno-myth in the public domain recently when he informed a group of journalists at an AFCEA (the Armed Forces Communications & Electronics Association) conference that "hackers" had altered information in a medical database by changing the data on blood types of soldiers. Several news sources subsequently reported the story. And it has already become an addition to the "lore" on the alleged "capabilities" of anonymous hackers. However, none of it was true. Money neglected to inform his audience that the "incident" was a simulation from another Pentagon wargame. Recently installed as head of a new DoD agency -- the Defense Information Assurance Program, Money has claimed that under his leadership the Pentagon is developing more offensive information warfare capability. THE RIGHT WAY, THE WRONG WAY, THE DOD WAY (One in an occasional series): REINVENTING THE WHEEL . . . GROUP Readers of Crypt News 50 may remember news of the planned sacking of the Air Force's 609th Information Warfare Squadron at Shaw Air Force Base, SC. A victim of publicity and professional reputation wars, the 609th's only crime was that it was good at what it did. Information warriors from the squadron commented to Crypt Newsletter that the entire reason the 609th was formed as a deployable computer security squadron was because the Air Force's Computer Emergency Response Team couldn't be counted on to handle hacking incidents in a timely or efficient manner. "The Defense Information Systems Agency (DISA) was good at dropping the ball, too," one added. So, delightful news it must have been then that the Pentagon has plagiarized the 609th Information Warfare Squadron (and much of the WheelGroup) -- it's mission, tactics and ideas, anyway -- as the Joint Task Force for Computer Network Defense (JTFCND), a new arm of the much loathed Defense Information Systems Agency. DISA claims its new arm will be the "first operational" information warfare squadron, an announcement which must surely be a knee-slapper to 609th crewmen . . . and employees of WheelGroup/Cisco Systems who comprised a former "deployable" cadre of info-warriors at the Air Force's Information Warfare Center (AFIWC) in San Antonio. If readers are confused and bemused by the apparently witless creation and destruction of manifold information warfare DoD squadrons, all with overlapping jurisdictions and tangled chains of command, they are not alone. So is Crypt News. So are DoD info-warriors. Among the current information warfare groups: the Air Intelligence Agency/Air Force Information Warfare Center, Arthur Money's Defense Information Assurance Program (DIAP), the 609th (not yet mustered out), the Defense Information Systems Agency, the Telecommunications and Networking Systems Operation (TNSO -- a division of Science Applications International Corporation that seemingly acts as part of the Pentagon), the Air Force Office of Special Investigations (AFOSI, Bolling AFB), the Naval Information Warfare Activity (NIWA) and . . . the Navy's Secondary Heuristic Analysis for Defensive Online Warfare (SHADOW) unit (no, Crypt News did not make this last one up) in Dahlgren, Virigina. And to name a few on the domestic side: the Computer Emergency Response Team (CERT -- not to be confused with AFCERT, the Air Force Computer Emergency Response Team or NAVCIRT, the Naval Computer _Incident_ Response Team), the Critical Infrastructure Assurance Office (CIAO, apparently a part of the Dept. of Commerce, and, yes, that's "goodbye" in Italian), and the National Infrastructure Protection Center (NIPC, a subunit of the FBI) . . . ====== Notes: Crypt Newsletter makes the modest request DoD officials name the next information warfare agency the Defensive Unit for Making Mincemeat of and putting the Kibosh on Opposing Penetration Forces (DUMMKOPF). HOW NOT TO USE THE INTERNET AS A PROPAGANDA TOOL: Anti-virus marketer caught manufacturing ringers. AVP anti-virus agent Rod Fewster submitted this good example of how _not to_ use the Internet as a corporate marketing aid. Recently, a representative of Panda Antivirus in the United States attempted to drum up some good publicity for his product at the expense of competitors. He posed as an independent "ringer" in the Usenet newsgroup alt.comp.virus in an attempt to start a discussion about the excellence of his company's product. Posing as a user named "Mike Reick," the Panda employee posted this message from the Internet provider Rivalnet. "Try Panda Antivirus for Exchange clients & Outlook 97/98 It is much more advanced than AVP, catches 100% in the wild . . . It's worked wonders for us." Shortly afterwards, "Mike Reick" posted another message extolling Panda Antivirus. Only in this case, "Mike Reick" entangled his "ringer" Internet account with his corporate account at Panda. "Pedro Bustamante wrote in message prod.itd.earthlink.net... "It says in one [anti-virus] review that you mention that Panda [Antivirus] has 7 products certified by Checkmark [a corporate certification.] In comparison AVP has 5, [Dr. Solomon has 6, [Network Associates] has 6 and [Norton Anti-virus] has 5. [Mike Reick] Fewster comments: "'Mike Reick' posted from dew@rivalnet.net . . . touting Panda as being better than AVP . . . [He] then [replied] with another shill designed to fool gullible readers into thinking Panda is better not only than AVP, but also better than NAI, Norton and Dr. Solomon. "However, '[Mike's'] plan fails miserably when he gets his accounts mixed up and inadvertently posts his message from pbustamante@pandasoftware.com, the corporate e-mail account of his alter ego, Panda's Pedro Bustamante. "This . . . is a classic example of what is colloquially [referred to] in Australia as 'stepping on your dick.'" "Yes, this was a low-handed, bone-headed post that backfired . . . 'Mike Reick' (dew@rivalnet.net) is the e-mail account which I have to filter spam . . ." commented Panda's Bustamente in a subsequent message to alt.comp.virus. OWN A DANGEROUS WEAPON FOR $29.95 CHEAP! "Cracking DES: Secrets of how encryption research, wiretap politics & chip design" (Electronic Frontier Foundation, O'Reilly) came in over the transom today. How Federal agencies subvert privacy, it said. How Federal agencies lie about privacy, while more inflammatory, is more accurate. Daringly, the book hands you the plans for the hardware, software and methodology for cracking the Fed national standard single DES encryption for something under $200,000 cash money -- the same plans EFF used to build its DES-cracking machine. Good scientists that they are, they challenge others to verify or attempt to refute their work. And they also cheekily exhort the reader to scan the plans and source code into digital form so that . . . uh, and they don't say this per se, the plans can be mounted on the Internet offshore, maybe like on a server in St. Kitts, for example, where it's not verboten -- "seriously illegal" is the authors' description -- like in the U.S. That is unless the National Security Agency or FBI leadership can somehow cajole the Joint Chiefs of Staff into unleashing the 2nd Heavy Bomb Wing from Barksdale, AFB, for an afternoon jaunt over the Caribbean. So you don't have that kind of loose cash or a handful of computer scientists who know how to use it laying around? Doesn't matter. The real point of the book is that when the government goes before Congress or other techno-illiterate organizations to claim that it does not have access to the resources needed to crack encryption used by criminals, it is being deceptive. "There is no brute force solution for law enforcement," said the NSA's Deputy Director William Crowell before Congress in 1997. Not exactly. You see, "Cracking DES" puts in the public domain the design specifications and board schematics, as well as the full software, for a turnkey machine that can smash single DES encryption. Since EFF could do it, the computer scientists who wrote the book reason the NSA is well into fourth and fifth generation systems based on similar designs and that it "probably" has machines that can be carried in a suitcase capable of cracking DES-encrypted files in a day and central units under Ft. Meade with the power to do thousands of such files in seconds. Last, EFF has put the plans for its DES Cracker into book form because, books, unlike electronic text, are a legal form of dissemination of this information _in this country_. The reasoning here is that while judges don't seem to understand that censoring electronic text is the same as censoring hardcopy, they do vaguely understand that the banning of books means the government is involving itself in "something fishy." If that sounds nonsensical to you, of course, be assured it is. But such are the interesting times we live in. This book is an effort to make the times a little less interesting and a little more rational. Although the average Joe will never see them, Crypt Newsletter reckons the ripples caused by the publication of "Cracking DES" in the opaque lake of secrecy that is the National Security Agency are running deep these days. NEW AUTHOR LOOKS FOR COLOSTOMY BAGBOY Indra Jamrach, the author of a book called "The Cybergypsies" set to be published by Viking/Penguin in July of next year, contacted Crypt News to discuss Colostomy Bagboy, the system operator of the old "Oklahoma Institute of Virus Research," sometimes mentioned in past issues. It seems Jamrach's book will also feature Bagboy, aka Paskell "Geno" Paris. In 1993 Paris ran a virus exchange bulletin board system and edited two issues of the underground publication, Vortex. Vortex was a profane, hideously violent e-zine that mixed extreme bad taste and off-color humor with exhortations to join the author in the "stylish destruction" of the data of others found in the silicon vortex -- Paris' euphemism for the world computer network. Like many electronic magazines from the underground it was exaggerated for effect, talking the talk and walking the walk of countless such publications. Federal and local lawmen indicted and arrested Paris the same year. He was subsequently convicted on charges apparently unrelated to his underground persona. A fraud charge stemming from the creation or usurpation of a false identity and a forgery charge resulting from attempts to counterfeit treasury bills landed him in prison. Paris also maintained computer tampering was also part of the conviction, coming down from what he _claimed_ was an unsuccessful attempt to access and meddle with the FBI's National Crime Information Center computer database. After serving two years in the hands of authorities, Paris was released. Jamrach said that he was an old user of Paris' "Oklahoma Institute of Virus Research" and "Cybergypsies" would contain tales of his trips to it. "In case you are wondering," Jamrach says, "my book isn't primarily about the virus scene, but about the people who roam cyberspace. The virus world forms a relatively small part of it and is mostly just Geno with some stuff about a couple of [people from the NuKE virus-writing gang] I knew. "I've also written about a group of people, mostly English, who played a role playing game which broke out of cyberspace and caused havoc in their 'real' lives, resulting eventually in the death of the network on which it was hosted . . . This whole is wrapped up in a personal story of modem addiction that nearly wrecked my marriage and is told as a series of interweaving anecdotes related to my wife while on a real life trip through Ireland. I think it's what's called a 'non-fiction novel.'" Jamrach hails from England and publication of "Cybergypsies" will be from Simon & Schuster there and precede the American release by two months. LETTERS ======= Gulf War printer virus spotted in France ======================================== Crypt: Got a call from a "lUser" the other day. She was worried about (I quote) "bad vibrations" from her laser printer. Did she mean physical vibrations causing her desk to shake? Or maybe microwave-frequency radiation frying her remaining few brain cells? Nope. The printer was sending out "bad vibes" as in "bad vibes, man." We sent a technician to pretend to change the main board and she's happy now. Incidentally, I show the introductory chapter of VCL to anyone who thinks that our office network is too complex. They're right of course, it's ten times too complex for normal people who just want to do their work and go home -- but, hey, the guys who sign the cheques read in PC-Porno magazine that their genitals would get bigger if they bought Microsoft Office, so who am I to complain? Nick Brown France --------------- ---------------------------------------------- Acknowledgments: Electronic clipping service courtesy of David Isenberg. ------------------------------------------------------------- George Smith, Ph.D., edits the Crypt Newsletter from Pasadena, CA. copyright 1998 Crypt Newsletter. All rights reserved. Crypt Newsletter's PGP public key. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.1 mQBtAy9uMW0AAAEDAMU9Dj5kvpNLBfD04jwBd7r07/c+uH/MtH8yKGEvR/y5wJUz I0BYZ+v1lFi6qIBuMJDzDzgOtvxKRV+wFW3AjqsHHX6m64VX/S9a0QqsTyLN71WE e5a4cFjN1fh1QnW9uQAFEbQoR2VvcmdlIFNtaXRoIDw3MDc0My4xNzExQGNvbXB1 c2VydmUuY29tPg== =IyYG -----END PGP PUBLIC KEY BLOCK-----