Teens Hijack Thousands of Net Accounts
A group of teenage computer crackers allegedly used thousands of stolen Internet accounts to probe the networks of two national nuclear weapons laboratories, according to law enforcement authorities in California.
At least five crackers, ages 15 to 17, compromised accounts at 17 Internet service providers in the United States, Romania, and Australia. They used the accounts to attack nine targets including the Sandia and Oak Ridge National Laboratories and Harvard University, according to Capt. Jan Hoganson of the Sacramento Valley High Tech Crimes Task Force in California.
The crackers managed to gain access to computers at Harvard, Hoganson said, but just scanned the national lab networks to look for vulnerabilities. The intruders stole 200,000 accounts alone from San Francisco-based Pacific Bell Internet Services for use in the attack.
According to Hoganson, the stolen accounts were used to scan for open network ports at the labs, which could be used for subsequent attacks. Hoganson emphasized that the laboratory networks themselves weren't compromised. He said law enforcement authorities were notified of the scans December 7, by an Internet service provider called InnerCite, which had received complaints from the labs that accounts it hosted were used in the scans.
"The feds say it was an unwelcome visit, but there was no criminal action committed," said Hoganson, who likened the action to nighttime intruders rattling the doorknobs of a locked business. "Fortunately, the Internet Service Provider preserved the evidence," he said.
Damian Frisby, a detective with the Sacramento Valley High Tech Crimes Task Force, said the FBI is now contacting other service providers from which accounts were allegedly stolen.
He said the young intruders, who allegedly belong to a cracking group called Global Hell, had been tracked down and contacted by authorities after they bragged of their exploits in Internet chat rooms. While no charges have yet been filed, Frisby said he expects that some of the attackers will eventually be charged with unlawful access of a computer and possibly grand theft.
"One of the first things an ISP considers is to shut these people down--which is great for security and stops the attack, but it makes it hard for us to track them down," said Frisby. "They should contact law enforcement, but they have to make the decision whether to track them down or cut them off, and we can't tell them what to do."
Frisby noted that while some of the compromised ISPs had chosen to cooperate with law enforcement, one, PSINet, demanded a search warrant before taking any action. "We don't want to violate anyone's rights, but it delays the process," said Frisby. PSINet wasn't available to comment on the request.
Frisby added that many of the compromised Pac Bell accounts used passwords that were easy to uncover using standard dictionary programs that search for known words. He said the attackers somehow obtained a list of 200,000 Pac Bell user accounts and were able to successfully steal the passwords for about 95,000 accounts.
Michelle Strykowski, a spokesperson for Pacific Bell Internet Services, a subsidiary of SBC Communications, based in San Antonio, disputed the number of compromised passwords. Strykowski said 63,000 passwords had been decoded, but Pac Bell was still unsure how the accounts were compromised. She said there has been no indication that the account information has been abused elsewhere and no customers have complained.
According to Strykowski, the company sent an advisory to customers January 7, warning of a security breach and advising them to change their passwords to include uppercase and lowercase characters, symbols and numbers, which makes them more difficult to crack. She said Pac Bell's 330,000 California Internet customers were also advised to change their passwords every 90 days and to not use the same passwords for a number of different accounts.
"Security is a top priority for Pacific Bell, and we are working closely with the police, but these hackers have proved to the Internet as a whole that we must maintain vigilance," said Strykowski, who noted that the Global Hell cracking group had also compromised Web sites at the FBI and the White House.
