H a c k e r s have a wide range of interesting machines to play with - on any given day, an average hacker probably has access to over a million dollars in computer equipment. Why, then, a chapter on se-curity and microcomputers? I can think of two good reasons: First, with more and more people using micros every day, it is becoming more important for users of these machines to think about the security of microcomputer data and programs. Second, just because hackers are not beating on the doors of your disk drive does not mean you are immune to the need for security precautions. There are, indeed, in-stances in which hackers can become interested in microcomputers (though perhaps these instances are more recreational than profes-sional), and there are instances in which a thief or some other intruder might find an office microcomputer quite fascinating.
Three categories of people need to worry about security when dealing with microcomputers: people who use microcomputers to ac-cess larger systems, those who use microcomputers in their business,
USING A MICRO WITH OTHER SYSTEMS
Autologon Macros
OUT OF THE INNER CIRCLE
and those who use microcomputers to run bulletin-board systems.
This chapter will look at the security needs of these types of users.
If you are like most people who use mainframes from a remote loca-tion, you use a microcomputer and a modem. A microcomputer used as a smart terminal can do a very good job of helping you work with larger systems, and it can provide much more power than a dumb terminal. A microcomputer can save data sent from the mainframe to the user; it can dial the computer and log the user on automatically; it can transmit files from the user to the mainframe; and it can be made to emulate different types of dumb terminals when necessary.
The only problem with using a microcomputer to access other systems is that, as you will see in the following section, you can find yourself "done in" by the same sophistication that makes your micro so easy to use.
Autologon macro is computer jargon for a type of computer short-hand. Although it may sound technical, the term simply refers to an AUTOmatic LOGON procedure that is stored as a MACRO which, in turn, is simply a long sequence of keystrokes (commands) represented and activated by, usually, a single keystroke.
Telecommunications software and other microcomputer pro-grams often enable users to store long strings of often-used commands as one or a few keystrokes. For example, with one common type of autologon macro, you simply tell your personal computer the system you want to call by entering its name. The macro then has your com-puter dial the number, connect with the system, and enter your ac-count name and/or password. It may even check your mail and log you off automatically. Autologon macros can be a great help, and I use them whenever possible. Macros save a great deal of time and effort, but they can also be a security risk.
The first and most common risk with these macros stems from the fact that microcomputer owners frequently trade software. Sup-pose, for example, you use macros for telecommunications with a computer on a network, such as THE SOURCE, or maybe with the
( HAP T E R H I H E Microcomputers and Security
secure computer back in the home office. You've told a friend how great your communications software is, and one day you copy the disk for your friend to try. This is someone you trust, so you hand over the disk without thinking anything of it. Think again. Your macros are stored on that disk - phone numbers, account names, passwords. Of course you can trust your friend, but what if your friend trades the disk, just as you did? I have received terminal programs that have moved through thousands of miles and at least ten people before they reached me. And when they did get to me, they included secret ac-count and password information that had not yet been discovered or used by other hackers.
Another problem with autologon macros is that hackers have been known to be able to activate them from a remote location, either via a bulletin board or over a mainframe. A hacker who ran a bulletin-board system would be able to tell the smart terminal (by sending the correct sequence of characters) to show him all the macros.
If you use a microcomputer for telecommunications and are an active member of the bulletin-board community, there is another potential risk you can eliminate with a little precaution: password security.
People who call bulletin boards usually have at least two or three passwords to remember - bulletin-board passwords, mainframe pass-words, network passwords. With several to many passwords to keep track of, it is very tempting to use one common password for all of your accounts - both bulletin-board and mainframe. Many people, in fact, do use the same passwords, even if they have only two or three to remember. Hackers are well aware of this, and bulletin-board owners are often sympathetic to hackers, so be careful. There's no point in using a private password to a secure system as a bulletin-board pass-word on a much less secure, much more public, system.
A business microcomputer poses its own types of security problems.
Because very few are even hooked up to the phone system, and almost none are hooked up to networks, hackers very rarely try to get into a business microcomputer. This same computer, however, may well be
Bulletin Boards
MICROS IN SMALL BUSINESSES
Micros and Hackers
Micros and Passwords
OUT OF THE INNER CIRCLE
open to theft of programs or data; so there are many aspects to micro-computer security in this area, as well.
The overwhelming majority of people who are qualified to work with microcomputers are not active hackers, but hackers do get jobs work-ing with computers, because they are generally well qualified by nature and, well, inclination for the work. If you gave such a hacker free access to your system, he might be unable to resist the oppor-tunity and decide to do some of his "work" from your computer and modem. If you didn't have a modem, he might provide his own with-out bothering to tell you abwith-out it. His hacking would probably involve setting up a program to scan phone numbers overnight or to execute a hack-hack on some large system.
In any case, the hacker may not be as careful as he would be at home, and if a legal problem happened to result, then you, as the owner of the computer, could be held responsible. You should consult an attorney for all the ins and outs in this rapidly changing area of the law, but on a day-to-day basis, there are two precautions you can use to try and avoid this problem in the first place: Limit use of the micro-computer and modem to certain people by using some type of lock and key, or familiarize yourself with the work being done on the com-puter and watch the people using the comcom-puter so that you can spot unusual activities quickly.
Microcomputers are well known for their lack of security, but in most cases, since these are single-user systems, these computers don't need better security. There are cases, however, in which an operating sys-tem for a micro or a minicomputer has a password feature that is spotlighted as a major security device but is one that turns out to be very easily defeated. In some instances, if the hacker removes a floppy disk at just the right moment, he can get around the password feature altogether. In others, he may find it possible to read the password files themselves, no tricks involved. It is more likely, though, that any of the techniques explained in Chapter Five would be much more effec-tive and easy to use on most micros than on even the least secure mainframe.
( HAP T ERN I N E Hicrocompulen and Securily
It doesn't take anyone long to walk up to a microcomputer and copy a file or two over to a pre-formatted disk. It is even easier if the person works in the organization and doesn't have to look out of place. Be-cause of this, a thief would find it much less difficult to go after a business with floppies he can access than a mainframe he would have to call. With microcomputers handling so many jobs these days, a busi-ness that keeps any type of secret data on a microcomputer has to be very careful in this regard.
A thief could, for example, copy the data to his own floppy disk, change it in a way that helped him, and replace the altered floppy. Or, he could just take the floppy and use the data to his own or a compet-ing company's advantage. Whatever he might decide to do with the data, one point is clear: The fact that users of the microcomputer have no idea of what's going on makes it easy to take or copy floppy disks. If the users were more aware, the thief would have as much trouble taking a floppy disk as he would taking a thousand-dollar bill.
Here are a few tips to keep in mind when managing a micro with floppy drives.
Educate users. At the risk of sounding like a bore, I'll stress this point again. User education is the most important aspect of computer security. I would guess that at least 90 percent of all computer crime depends on the unwilling aid of people who don't know what they are doing. And wherever there are confused people, there are other peo-ple waiting to profit from their confusion.
Keep floppies under Jock and key. Some owners of business micro-and minicomputers keep a lock on the disk-drive door. This is a good idea, but it is also important to have the floppy contents of the drive locked away when they are not in use. And perhaps the most impor-tant thing to remember is: Keep the backups as secure as you keep the originals. It's funny, but some people guard their original disks as closely as they can, but they leave their backups lying around like dead leaves. I suppose there's something very human in thinking that a copy is a copy ... is not an original. But we're talking about computer data, not Rembrandts. To a computer, a copy is a copy is an original, and the moral is: Only the people who need to use any floppies need to have the key to access them.
FLOPPY DISKS AND SECURITY
OUT Of THE INNER CIRCLE
Keep inventory. This precaution is so that you will know if one of your disks is missing. An inventory can be your microcomputer equiv-alent of a mainframe user log, and if you keep records of who used which disk, when, and for what job, it may also help you to find out who took a disk without authorization, because you will have a good idea of when it was taken and who had access to it at that time. Once again, remember to treat backup disks or tapes as carefully as you do your originals.
Data encryption. There are quite a few data-encryption software packages available for microcomputers, and in many ways they could solve the security problems facing microcomputer owners. If all data were encrypted as it was saved, and then decrypted as it was read, all data on any disk would be unreadable and unchangeable to a thief.
There are a few pitfalls involved with data encryption, however.
First, the key has to be closely guarded against both loss and discov-ery. A lost key could mean lost data because the key is not saved on disk with the data, as a password is. In the worst case, suppose that the only person who knew the key died. That data could be lost forever.
On the other hand, loss could also mean loss of data in the sense of an employee who leaves your company on less than friendly terms - with the key memorized - and goes to work for your biggest competitor.
Another pitfall is one that encryption has in common with pass-words: People choose keys that they can remember, and that hackers can often guess.
Be conscientious about keeping backups. I don't mean just backups on disks or tape. Of course you need these, but you should always have some kind of written record of all the transactions you make. The computer has not yet replaced paper and ink; it has only made paper and ink easier to deal with. Information stored on magnetic media is very volatile and easy for someone to destroy.
Once again, you have to treat all your floppies as if they were original data. In some cases, a thief will find it impossible to get to orig-inal floppy disks, but he can quite easily get to the backups. As I said earlier, he could then do one of two things, depending on his motives.
He might create and alter a new backup in his favor and damage the data disk being used (with a magnet, perhaps, or power surges or one
( HAP T E R H I H E Hicrocompulers and Securily
of many other physical attacks). The company would find that its data disk is damaged and be forced to use the altered backup. On the other hand, of course, a thief could just back up the backup, take one, ... and no one would be the wiser.
At this time, small businesses that use microcomputers seem to have more trouble finding employees to run computers than they do decid-ing on and buydecid-ing the machines themselves. After spenddecid-ing $15,000 on a computer system and wondering what to do with it, they have been forced to hire one person who "seems to know what he's talking about." What follows is one person telling twenty other people how to use the computer system.
In many cases, a situation like this will tempt the one person who knows what he's doing to use the system to his own advantage: keep personal records on the system, or print personal letters. After all, there's no harm being done. In other cases, the person who knows what he's doing might find it very simple to print more paychecks for himself or to have his expense-account check automatically padded every month. This kind of crime is known to experts as "data did-dling," and it is different from the "pure" variety of hacking that's primarily the subject of this book. Still, since there is no one to check on these "diddles," they could go on for a long time without being discovered. In fact, they have - with and without computers - for as long as embezzlement has been a definable word.
Another thing that this type of "expert" employee usually turns out to be good at is writing software for the employer. It would be a very simple matter, however, for such an employee to throw a trap-door or two into his other programs-some software authors would. In most cases the trapdoor would just be a little secret, not meant to cause any harm, but put there for fun by the author. It could be, however, that the author puts in a trapdoor so that he will always have access to the accounting programs, or so that he can access the payroll program whenever he wants to find out who is getting paid what. In any case, once trapdoors are in your system, they can be almost im-possible to find without hundreds of hours of detective work by a skilled and thorough computer professional.
Employee Risks
BULLETIN BOARDS
Bulletin Boards In General
OUT OF THE INNER CIRCLE
Now we have come to the "recreational" side of hacking and micro-computers. Aside from such matters as password security, which was discussed earlier, most business users will probably have little direct interest in bulletin boards - their attraction is mainly social or profes-sional, rather than business related. Still, hackers use bulletin boards for two interesting reasons: one, to communicate what they know, and two, to crash the system and thus irritate a lot of people at once. The first reason is more important to you as a user, owner, or operator of a large computer. The second is, well, interesting for its own sake.
In order to understand how bulletin boards are used (and mis-used), you need to understand what they are and what they do. First, we'll look briefly at the ways bulletin boards are set up, used, and maintained. Then, for those of you who have never seen a bulletin board, I'll show you two samples - one public and freely accessed by anyone, and one private and for hackers' use only.
A bulletin-board system, often abbreviated to BBS, is usually a per-sonal computer equipped with a modem and special software that allows people to call in and use the system. Often, the bulletin board is set up and left permanently running as an open forum for anyone who feels like calling in. In other cases, the bulletin board is open during certain specified hours. In any event, a bulletin board is almost always set up as a free service by a special-interest group that simply wants to make such a system available to others.
A microcomputer - or any computer, for that matter - becomes a bulletin-board system by virtue of its special program, which allows the computer and modem to "listen" to a telephone line for a phone call. Whenever an outside computer equipped with a modem calls the telephone number of the bulletin-board computer, the BBS software allows the host system to record input from the remote computer. In many cases, the software can also transmit text or even programs to the remote computer. BBS software is also responsible for keeping track of messages that various users place on the bulletin board, and most bulletin-board software offers options for both public and pri-vate messages - users can send private mail to one another or they can post public messages for everyone to read.
( HAP T I R N I N E Hicrocomputm and Security
When people call bulletin-board systems, they are usually asked to enter their names and/or some type of password for identification.
Since bulletin boards almost never charge for their services, this pass-word feature is designed to give the system operator some control over who can and who cannot use the bulletin board. In every case I have
Since bulletin boards almost never charge for their services, this pass-word feature is designed to give the system operator some control over who can and who cannot use the bulletin board. In every case I have