GENWiki

           COMPUTER RAIDERS HIT BIG CREDIT FILE

06/22/84

COMPUTER BUFFS USING HOME TERMINALS HAVE BROKEN INTO ONE

        OF THE LARGEST CONFIDENTIAL DATA FILES IN THE WORLD. THE TRW
        INFORMATION SERVICES DIVISION'S COMPUTERS HOLDING CREDIT
        HISTORIES OF 90 MILLION PEOPLE.
           THE SYSTEM WAS ENTERED AFTER SO-CALLED COMPUTER HACKERS
        GOT ACCESS TO A SECRET PASSWORD AND A MANUAL ON THE SYSTEM'S
        OPERATION. THE PASSWORD LEAKED OUT MORE THAT A YEAR AGO, BUT
        TRW OFFICIALS WERE NOT NOTIFIED UNTIL TWO WEEKS AGO.
           TRW INFORMATION SERVICES IS A CREDIT BUREAU THAT TRANSMITS
        OVER TELEPHONE LINES SUCH INFORMATION AS CREDIT HISTORIES,
        EMPLOYMENT RECORDS, BANKRUPTCIES, LOAN DELINQUENCIES AND
        SOCIAL SECURITY NUMBERS. THE SERVICE IS USED BY MORE THAN
        24,000 SUBSCRIBERS, INCLUDING BANKS AND DEPARTMENT STORES,
        AND CAN BE REACHED FROM MORE THAN 35,000 LOCATIONS.
           TRW OFFICIALS SAID THAT ALTHOUGH THE BREAK-IN ALLOWED HOME
        COMPUTER USERS TO READ CONFIDENTIAL FILES, THOSE USERS WOULD
        NOT BE ABLE TO CHANGE THE FILES. CHANGES ARE SUBMITTED
        MONTHLY ON TAPE, AND FILES ARE NOT ALTERED THROUGH THE
        ON-LINE COMPUTER SYSTEM.
           TRW OFFICIALS SAID THE PASSWORD AND MANUAL WERE OBTAINED
        FROM A SEARS ROEBUCK STORE IN SACRAMENTO THAT SUBSCRIBES TO
        THE SYSTEM. COMPUTER BUFFS EVENTUALLY POSTED THE CODE NUMBER
        ON AN "ELECTRONIC BULLETIN BOARD," WHICH ANY HOME COMPUTER
        USER WITH THE RIGHT EQUIPMENT CAN READ BY USING A TELEPHONE.
        IT IS NOT KNOWN HOW MANY TIMES PEOPLE BROKE INTO THE TRW
        SYSTEM, BUT SOURCES SAID THAT IT HAS BEEN COMMON KNOWLEDGE
        FOR MONTHS AMONG MANY COMPUTER BUFFS THAT THE TRW FILES COULD
        BE ENTERED EASILY AND CREDIT RECORDS READ.
           THE BREACH WAS FIRST REPORTED BY NEWSDAY, WHICH QUOTED
        UNNAMED COMPUTER HACKERS AS SAYING THE TRW SYSTEM WAS ENTERED
        NOT ONLY TO READ CREDIT RECORDS, BUT ALSO TO "EXPEDITE CREDIT
        CARD FRAUD" BY FINDING OUT WHETHER A PERSON WHOSE CREDIT CARD
        WAS STOLEN HAD A LARGE CREDIT LIMIT.
           TRW SAID THE LEAKED PASSWORD HAS BEEN CHANGED AND THAT NO
        OTHER CODES ARE BELIEVED TO BA AVALIABLE TO HACKERS. THE
        NEWSDAY STORY, HOWEVER, QUOTED SOURCES WHO SAID THAT OTHER
        CODES THAT PROVIDE ACCESS TO OTHER TRW FILES ARE STILL
        CIRCULATING.
           REFERRING TO THE AMOUNT OF TIME IT TOOK TRW TO LEARN ABOUT
        THE PROBLEM, JEROME SALTZER, A SPECIALIST IN COMPUTER SYSTEMS
        AND COMMUNICATIONS AT THE MASSACHUSETTS INSTITUTE OF
        TECHNOLOGY, SAID, "THAT IS A DISTURBING . . . FAIRLY
        APPALLING AMOUNT OF TIME FOR SOMETHING LIKE THAT TO GO
        UNDETECTED. IF TRUE, IT SUGGESTS THAT THE COMPANY DOESN'T
        REGARD THIS INFORMATION AS VERY IMPORTANT TO PROTECT . . . .
        THEY ARE NOT VERY CONCERNED ABOUT PROTECTING PEOPLE'S
        PRIVACY." HE SAID THAT RELATIVELY SIMPLE MONITORING
        TECHNIQUES SHOULD PICK UP THAT KIND OF SECURITY BREACH
        RELATIVELY EARLY.
           COMPANY OFFICIALS SAID IT IS POSSIBLE THAT UNAUTHORIZED
        ACCESS COULD HAVE BEEN OBTAINED THROUGH A DEPARTMENT STORE
        LINE OR A SIMILAR LINE ON WHICH MANY REQUESTS FOR CREDIT
        INFORMATION ARE PLACED DAILY. ON SUCH A LINE, THEY SAID, A
        FEW EXTRA REQUESTS MIGHT NOT BE NOTICED.
           SALTZER SAID THAT A SYSTEM WITH 35,000 ACCESS POINTS IS
        DIFFICULT TO POLICE AND THAT ANYONE RUNNING SUCH A SYSTEM
        WITHOUT ELABORATE SECURITY PRECAUTIONS MUST ASSUME THAT A FEW
        OF THE THOUSANDS OF PEOPLE WHO HAVE ACCESS TO IT MIGHT SELL
        THE CODE OR OTHERWISE MISUSE THE SYSTEM.
           AMONG THE SECURITY MEASURES TRW COULD HAVE TAKEN ARE
        REQUIRING THE USER TO BE CALLED BACK AT A CERTAIN PHONE
        NUMBER BEFORE INFORMATION IS SENT; CHANGING SECRET CODES MORE
        OFTEN, AND INSTALLING DEVICES ON SYSTEM TELEPHONES THAT TRADE
        RECOGNITION SIGNALS WITH THE CENTRAL COMPUTER BEFORE
        INFORMATION IS SENT.
           A RECENT AMERICAN BAR ASSOCIATION STUDY FOUND THAT 27
        PERCENT OF THE 275 BUSINESSES AND PUBLIC AGENCIES IT POLLED
        HAD BEEN VICTIMS OF COMPUTER CRIME, SUFFERING LOSSES OF HALF
        A BILLION DOLLARS LAST YEAR.
           JONN    PARKER, A COMPUTER SECURITY EXPERT AT TRW
        INTERNATIONAL IN SENLO PARK, CALIF., SAID A ROUGH SURVEY HAS
        COUNTED ABOUT 1,400 COMPUTER CRIMES IN THE UNITED STATES OVER
        THE PAST TWO DECADES. HE SAID THAT MANY LARGE COMPUTERS
        HAVE INSTALLED SECURITY SYSTEMS, BUT THAT THERE IS A
        TRADE-OFF BETWEEN SECURITY AND THE COST AND CONVENIENCE OF
        USING A COMPUTER SYSTEM -- THE MORE SECURITY USED, THE
        COSTLIER AND MORE INCONVENIENT IT BECOMES.
           THE TRW SYSTEM USED TWO CODES, A SEVEN-DIGIT CODE TO
        IDENTIFY THE USER AND A SHORTER "SECRET PASSWORD," SOURCES
        SAID. THE FIRST CODE IS LESS GUARDED AND RELATIVELY EASY TO
        OBTAIN, AND THE SHORTER, "SECRET" CODE, THEY SAID, IS "FAR
        TOO EASY" TO CRACK.
           IF IT CANNOT BE SHOWN THAT THE TRW BREAK-INS WERE USED TO
        COMMIT FRAUD -- IF THEY WERE MERELY CURIOSITY TRIPS BY
        COMPUTER HACKERS -- THEN IT WOULD BE UNCLEAR WHETHER THEY
        WERE ILLEGAL, ACCORDING TO A COMPANY SPOKESMAN. THE COMPANY
        HAS BEEN AMONG THOSE SEEKING STRONGER LEGISLATION TO FIGHT
        COMPUTER CRIME.
           ABOUT 25 STATES HAVE COMPUTER CRIME LEGISALTION, BUT
        OBTAINING "UNAUTHORIZED ACCESS" TO CONFIDENTIAL INFORMATION
        IS CONSIDERED A CRIME IN ONLY A FEW.