1991 06 00 Computer Fraud & Security Bulletin - Vol 1991 No 6 - Menkus

Magazine Overview

Title: Computer Fraud & Security Bulletin
Issue: June 1991
Publisher: Elsevier Science Publishers Ltd
Country: UK
Language: English
ISSN: 0269-2909
Price: £25

This issue of the Computer Fraud & Security Bulletin from June 1991 covers several significant security incidents and legal proceedings related to computer systems and data.

Zenith Loses Ministry of Defence Contract

The UK's Ministry of Defence (MoD) has cancelled a multi-million pound contract with Zenith Data Systems, originally awarded in October. This decision follows a security incident in January, detailed in a previous issue, involving the theft of a laptop containing classified Gulf War plans. The MoD has subsequently reviewed its laptop purchasing policy, introducing a new requirement that all laptops must feature removable hard disks. Traditionally, MoD procedures for sensitive data mandate storage on removable media. While Zenith and Toshiba systems were common, Grid Systems were used for 'secure laptops'. The original Zenith Slimport deal was for a model where the disk was inaccessible under the keyboard. Zenith proposed a modified, heavier older model as a replacement, but the contract was ultimately awarded to Compaq for its LTE 286 model with a removable hard disk.

UFO-hunters Infiltrate US Government Computers

A group of British hackers reportedly infiltrated a US Government data network in October 1990, with the intrusion only being discovered in January of the current year. The network in question belongs to the US Agriculture Department's Animal and Plant Health Inspection Service (APHIS), an agency responsible for inspecting imports of plants and animals. APHIS connects 500 terminals at its headquarters with over 175 terminals across 40 field offices. The hackers gained access via the US Sprint Communications TeleNet public network, employing sophisticated file search methods and appearing to have accessed the source code of the APHIS network. Their activity was noted in APHIS field offices in Jefferson City, Missouri, and Wilmington, North Carolina, as well as the Hyattsville headquarters segment. In response to the unauthorized access, APHIS representatives stated that passwords were changed and more complex user personal identification codes were implemented shortly after the discovery.

Sun Designer Admits Hacking

Robert Gilligan, a senior software designer at Sun Microsystems, has pleaded guilty to obtaining confidential customer information from Pacific Bell. He faces a sentence of three years probation and a $25,000 compensation payment to the telephone company. As part of his plea bargain, Gilligan has agreed to cooperate with US authorities in prosecuting Kevin Poulsen and Mark Lottor, who are also implicated in eavesdropping offenses. Furthermore, Gilligan has offered assistance to the victims of the hack in addressing security vulnerabilities in their networks. Gilligan, Lottor, and Poulsen were previously charged in April 1990 on 19 counts related to using personal computers, stolen Pacific Bell equipment, and stolen access codes to access government and telephone network computers. Their alleged objective was to obtain classified military documents and FBI information concerning associates of the late Philippine president Ferdinand Marcos. Had he been convicted on the original charges, Gilligan could have faced up to 20 years in prison and a $30,000 fine. Gilligan's attorney claims his client became involved with individuals who sought to exploit his networking expertise. Gilligan has admitted accessing the US Army's Masnet Computer network but asserts he only reached the login screen, which displayed a warning against unauthorized entry. He claims to have printed this screen and given it to Poulsen. Federal officials, however, suggest that Gilligan's involvement was more extensive.

Recurring Themes and Editorial Stance

This issue highlights the growing sophistication of computer crime and the challenges faced by government and corporate entities in maintaining data security. The articles underscore the importance of robust security measures, including physical security of hardware (removable disks) and complex access controls. The editorial stance appears to be one of reporting on significant security breaches and legal actions, emphasizing the need for vigilance and proactive security practices in the face of evolving threats.