Roanoke Times
Copyright (c) 1995, Landmark Communications, Inc.
DATE: TUESDAY, January 24, 1995 TAG: 9501250038
SECTION: BUSINESS PAGE: B-8 EDITION: METRO
SOURCE: Associated Press
DATELINE: NEW YORK LENGTH: Medium
Hackers have discovered a new way to ``hijack'' computer systems linked to the Internet, threatening security to millions of computers in the global network, authorities warned Monday.
Many systems that were thought to be protected by sophisticated hardware and software ``firewalls'' now are vulnerable to theft and eavesdropping, said an official at the government-financed Computer Emergency Response Team.
``Even when you bought a security package for the Internet ... there is no security'' from the new type of attack, Tom Longstaff, manager of research and development at the CERT coordination center in Pittsburgh, said in a telephone interview.
Intruders using the new technique can copy or destroy documents or do other damage by masquerading as an authorized user, CERT said in an advisory distributed Monday on the Internet.
``Once the attack is completed, it is difficult to detect,'' the advisory said.
It is not clear how many attacks already have been reported, Longstaff said.
The New York Times reported Monday that the new type of hacking began on Christmas, when an unknown intruder or group broke into the computer of Tsutomu Shimomura, a computer security specialist at the San Diego Supercomputer Center.
The Times said the culprit or culprits controlled the computer for more than a day and electronically stole a large number of security programs.
About 20 million people use the global Internet, and it's expected to continue growing rapidly as a medium for commerce.
Experts fear the new type of hacking could result in widespread theft of merchandise, credit-card numbers and digital ``cash'' unless businesses take better security precautions.
``Essentially everyone is vulnerable,'' James Settle told the Times. Settle, a former FBI computer-crime expert, is now an executive at the Inet Corp., a computer-security firm.
The intruders fool computers into believing that a message is coming from a trusted source, using a method known as Internet protocol spoofing. By posing as a familiar computer, an attacker can get access to protected computer resources and seize control of what was considered a well-guarded system.
Then the intruders can use a ``hijacking tool'' to take over connections from any user on the system, the advisory said.
Classified government computer systems are not thought to be at risk because they are not connected directly to the Internet, the Times said.
The Internet originally was created by academic researchers to share computer data easily around the world.
The advisory listed brands of computers that are vulnerable to Internet protocol spoofing and said some types of networks already include filters that should prevent the attacks. For other brands, a filter must be installed.
CERT said there's no way to prevent use of the ``hijacking tool'' once an intruder has gained access to a computer system.
The solutions are difficult, Longstaff said. ``Sometimes it's hard to understand why you're doing a solution, even for experts, which is what makes this particular problem so insidious.''
by CNB