Avoiding A Hack Attack

The computer break-in at the world's premier software-maker provides a stark reminder that U.S. companies and individuals have a long way to go to implement security that protects trade secrets and personal privacy.

Security experts say more Americans need to be sensitized to the fact that a single computer with outdated software can give hackers or thieves the entry point they need to invade a computer network.

"It really only takes one computer to not be updated for something to compromise the entire network," said Steve Trilling, director of research at Symantec Corp.'s Antivirus Research Center.

And as the Microsoft case shows, solving such a crime may be far more complex than the typical burglary because the perpetrators could have wreaked the havoc from overseas - using the Internet.

The break-in into Microsoft's Redmond, Wash., headquarters is suspected to have been carried out from an e-mail address registered in Russia and could have involved other nations too. And that means investigators have the added burden of dealing with international laws and getting cooperation from foreign police agencies.

Investigators were stymied earlier this year when the suspected "Love Letter" virus author was set free in the Philippines after it was determined that the country had no law against hacking.

"You may have to worry about the level of cooperation with Tibet, Uzbekistan, or wherever," said Mark Rasch, a vice president at computer security firm Global Integrity in Reston, Va., and a former Justice Department official. "If these guys are really good, it's not going to be easy."

Experts agreed that with hacking tools publicly available and easy to use, everyone - from the largest corporation to individual home users - should pay more attention to security.

People telecommuting from home makes the job even harder. Not only must there be a secure connection, but a home user is more likely to open up an e-mail attachment that could contain a virus. Other family members might use the computer as well, presenting more security risks.

Microsoft might have been protected against this attack, Trilling said, simply by regularly changing its password or taking five minutes to update virus protection software.

The QAZ Trojan, the tool said to be used to steal its passwords, was discovered in July, and all major antivirus programs now protect against it. But many home users don't update their antivirus software regularly, so they're not protected against new viruses.

Chris Rouland, director of the Atlanta-based Internet Security Systems' X-Force, expressed surprise that Microsoft relied only on passwords, and not secondary security systems such as biometrics or a revolving access key.

Biometrics uses a person's physical attributes to confirm identity, such as retina scans or a fingerprint analysis. An example of a revolving access key, used by America Online for its high-security accounts, would be a ke chain with a numeric password that changes every 60 seconds. The computer knows what the number should be at any given time, and only the key chain holder could duplicate it.

"It raises the whole awareness that security solutions aren't just firewalls and passwords," Rouland said.

Rasch said security is more of an education issue than a technological one, with consumers needing to know what tools they need and how to use them. Users with high-speed, always-on connections are even more at risk, he said.

"You have to have anti-viral software up and running, and train people not to open files when they don't know where they came from," Rasch said. "Individuals need to start purchasing and deploying personal firewall products, especially people with DSL or cable connections."

Rather than a blunt-force attack like the assaults that jammed popular Web sites in February, the Microsoft incident was a lot more daring - and potentially more fruitful.

It's easy to find and use the same hacking tools probably used against Microsoft, so almost anyone could have done the deed, though this was an intricate attack for a novice hacker.

"Unlike a computer virus, this required multiple penetrations and multiple attacks," said Rasch. "Each time you do something, you have the opportunity to mess up. It increases the likelihood of getting caught."

At the same time, Rasch said, an adept hacker could wipe out his tracks.

"The degree of determination and dedication that was necessary is huge," Rasch said. "They had to execute many different things at many different times."

© 2000 The Associated Press. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed