|
Digital Detective Workshop
12/7/99
Mike Hudack
Editor-in-Chief
Research on DIRT, a supposed wiretapping device sold by Codex Data Systems brought me to a phone call with Frank Jones -- the man behind the grime he calls DIRT. The conversation jumped from subject to subject, generally focusing on how his software worked and how much he could really tell me. Eventually he extended an invitation to attend the Digital Detective Workshop, which teaches "how to use the Internet & high-tech software for digital evidence acquisition."
DIRT won´t be addressed in this article. The software, supposedly used by the government for "digital wiretapping purposes" will be the stuff of another article. Rather we will focus on the Digital Detective Workshop.
What it Is
The Digital Detective Workshop, in this case at least, is a conference aimed at private sector system administrators and security directors interested in securing their systems from the outside world. For $500 plus transportation and lodging visitors receive a day of presentations, a binder of Power Point presentations, free continental breakfast, lunch and cocktails and a CD-R littered with "hacking software."
Getting In
I arrived at the conference about half an hour before it began and would be forced to leave about three hours later for a previous engagement in the City (New York that is). I arrived at the door to the conference room and was met by a huge burly man in a Codex Data Systems polo shirt about three sizes too small. A nametag dwarfed by his huge biceps read "security."
I immediately saw John Vrasenevich, editor of AntiOnline, the "keynote speaker" for this conference of twenty. I immediately extended my hand to him, saying "hi John" and looking him straight in the eye. John promptly lowered his eyes to the floor and stalked out of the room.
The security guard immediately asked me if I was previously registered. I quickly announced that Frank Jones had invited me to attend as press, and that I wasn´t previously registered. "Name?" I quickly supplied him with my name and my place of business (Owl Services, publisher of OSAll, a computer security magazine). John Vrasenevich, the lanky "security expert" had up until now been standing meekly in the hall. He quickly jumped forward, cupping his hand over his mouth and the security guard´s ear.
"Excuse me for a minute," the guard said gruffly. He moved to Frank Jone´s side quickly, crossing the tiny conference room in a single bound. After some hurried whispering Jones made a "it´s okay" motion. The guard returned, gave me a binder full of powerpoint printouts and showed me to a table.
Initial Impressions
Mr. Jones had warned me that "only 25 people would be attending." He explained the size of the workshop away as "the holidays" and "timing." Suffice it to say there were even fewer people there. A generous count included twenty -- twenty-five if you count conference staff.
I arrived in the middle of a presentation by Terrance Kawles, vice president and general counsel of Codex Data Systems. The presentation, entitled "Types of Computer Crime. Cyber Law Basics" left me with a sour taste in my mouth from slide one -- or at least the first slide I was there for. "Computer crime is costing BILLION$!" exclaimed the Power Point slide. The audience oohed and aahed with the slides, dutifully refusing to raise questions as to how these figures were tallied. My own questions were quickly shirked aside with little consideration.
Kawles continued, claiming that "FBI National Computer Crime Squad Statistics" state that "85% to 90% of computer intrusions are not even detected." He continued spreading fear uncertainty and doubt by saying that "The Cyber threat is here... National communications systems, power grids, banking & financial institutions, airlines, hospitals, the military, and law enforcement [are at risk]."
Kawles´ speech wrapped up with a brief overview of what "outdated and insufficient" laws apply to computer crime. Issues of jurisidction were discussed in-depth as well.
Clicks & Daggers
Frank Jones, a pot bellied ex-cop wearing a stretched Codex polo shirt gave the next presentation, artfully entitled "Clicks and Daggers." Jones began his presentation by announcing that "The Cold War is over -- spies are out of work but we still have espionage -- economic espionage." According to Jones, the "potential poips" (Ex-cop accent added) include "trans-national organized criminals, `mercenary´ hackers/crackers, mobile & ethically flexible employees and national governments."
Jones goes on to list a number of "[technologies that] enable new threats" such as "SATAN, Ballista, sniffers, spoofers, anonymous re-mailers, e-mail bombers, cable modem compromises and network monitoring software." As examples Jones tells us to "consider Jesse James & Willie Sutton," saying that "vigilante justice & corporate self-help will be common."
To Jones´ credit, his entire presentation isn´t so full of fear uncertainty and doubt. He says that "integrated [information] protection program to enhance & focus existing efforts [is necessary]." He goes on to say that "background investigations, ID badges, visitor sign-in & escort and periodic computer forensics" are all necessary. At no time does Jones go into detail about how these forensics (or any other such measures) should be gone about, besides saying that firewalls should be put in place and strong cryptography should be used. He also throws around buzzwords like "enhanced authentication and intrusion detection systems."
Missing Out
Unfortunately a previous engagement kept me from attending the rest of the lecture. According to the lecture notes, however, I missed little if anything. Session Three, "How to bypass boot passwords, crack protected files and bypass encryption" seemed vaguely interesting, as did Session Four, "tracing the source of e-mail, tracking a suspect online, tracking online activity, tracking software piracy and tracking stolen laptops and PCs." The following two sessions were remarkably similiar.
What I really missed out on, in my humble opinion, was John Vrasenevich´s keynote speech.
DIRT
An article on OSAll within two weeks will tell you all about DIRT, Codex Data Systems´ flagship product. |
