To: Paul Fiondella who wrote (34489 ) 10/29/2000 10:35:34 AM From: PJ Strifas Read Replies (1) | Respond to of 42771 <OT> Hacking and the "Mind of the State". I've been an avid researcher/reader of the workings of "State sponsored stealing of secrets" for many years. It all started when I read an account of how Xerox copiers were sold to the Soviet Union (illegally at the time) that tracked every document copied and this information was passed back to the US (via the CIA). [Side note: with more and more devices attaching to the internet, stealing secrets is as easy as perhaps doctoring a device - say a printer/copier/data storage device - to use the internet to send information back to whomever wanted that information. Just a thought :)] Now, there are many ways this hacking incident could play out. We have focused on the obvious - someone has stolen the secret code of software developed by the most dominant software company in the world. The ramifications are huge (no one can deny the endless possibilities or even probabilities). Anyone with this software can do untold number of things with little (or less) effort than before. This includes virus writing, security breaches, and outright software cloning. But what if it really plays in the inverse? The software "stolen" was left in the open for the hackers. Think about it, why wasn't the hacker's access universal? Why did they not have access to more products? Or is MSFT being honest about the number of products compromised... But sticking with the current story - only some specific code was exposed during the 5 (or 12 depending on which report you believe) weeks of free access? I don't know about you, but if the hackers can get in (which is probably the hardest part) they why couldn't they get anywhere within the system they wanted to? (sure, the passwords they stole were to accounts that did not have higher access rights but that answer is too naive to be considered. I know of about a dozen programs that I could copy to an NT workstation/server that will bypass the security and allow me FULL access to data on that server. Not to mention allow me to CHANGE passwords to other accounts.) I remember reading that during the 1960's, the Soviet Union played tricks with telemetry data from their ICBM rocket testing (they rigged data telemetry to show their rocket's were NOT accurate enough for a preemptive first strike). This information was widely distributed in the US government and in fact played a role in the adoption of US nuclear policy! There's nothing to suggest this but what if the software wasn't really "stolen" without knowledge but actually "left in the open" for someone to steal? If you want to believe that employees at MSFT only started to read the server logs just the other week and not EVERY day of every week (which is probably more to the truth), then you can believe the current story entirely. But if MSFT had uncovered the break-in early on and left some source code out there as bait....They say the greatest trick the Devil played was to convince people he didn't exist. Regards, Peter J Strifas