From: fc@all.net (Fred Cohen)
Date: Sat, 23 Dec 1995 03:58:39 +0800
To: dreschs@austnsc.tandem.com
Subject: Re: Air Force hacks Navy? Eeeek!
In-Reply-To: <55wx7p3vfz.fsf@galil.austnsc.tandem.com>
Message-ID: <9512221857.AA17752@all.net>
MIME-Version: 1.0
Content-Type: text


> 	I saw the IW article that Light Ray saw in the RISKS Digest,
> and, while it raises some valid questions, it in turn has some internal
> problems.  For example, the IW author apparently doesn't understand the
> difference between a Navy captain (O-6) and an Air Force captain (O-3),
> dismissing the whole story because a Navy captain would be far to old to
> be a 'whizzkid'.

Am I reading a different article? What I read was that the IW person
talked to several inside sources and found out and reported facts.  S/He
made a mistake in saying Navy instead of AF somewhere in his posting to
Risks and fixed it before sending it to the IW list (which is where I
got it).  From what I read, s/he found out the truth from people who
knew the truth and tried to get the word out.

> I would have been able to make captain at 24).  While the ET article
> looks like it was written by someone who didn't understand the fine
> details of what happened, the IW article looks like it was written as
> military smokescreen.

I thought the ET article indicated an exaguration, but if it's true that
there are no Battleships in the US Navy anymore and that the attack was
run using DoD crypto equipment and networks, it's a heck of a lot
different than buying an off-the-shelf Internet package and taking down
the fleet.

I have no doubt that someone with enough expertise, classified knowledge
and equipment, access, and assistance can get some limited control over
some US Navy ships for some period of time - but I seriously doubt that
a computer whizzkid can take over the fleet from a PC via Email.

-> See: Info-Sec Heaven at URL http://all.net/
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236