Back Orifice virus victims helped by accused: witness

By PETER GRIFFIN technology writer

Alleged hacker Andrew Garrett was actively involved in helping victims of hacker attacks, a court heard yesterday.

A defence witness in Garrett's trial told the court that Garrett was part of an internet chat group set up to help computer users rid themselves of the same virus he is accused of using to gain internet access passwords.

Web-support worker Lisa Ryan, flown from Australia to give evidence in the Manukau District Court, said she met Garrett online in an Undernet chat channel called Back Orifice in September 1998, just a month after he had allegedly used the Back Orifice "Trojan" computer program to obtain the passwords of internet service providers, including Telecom's Xtra.

She said Garrett was one of a group working online voluntarily and under supervision to clean the computers of users infected by the Back Orifice virus, which had been unleashed across the internet in July 1998 by a group of hackers known as the Cult of the Dead Cow.

"We were cleaning on average 200 people's PCs per day as a team worldwide," she said.

"The virus companies hadn't caught up. Initially none of the anti-virus software products detected Back Orifice."

Ms Ryan added that the computer users had full knowledge that their computers were accessible by the Back Orifice help team, but said some team members would take extreme action to alert "stubborn" users to the fact they were infected.

"Sometimes you'd do something to show [computer users] they really did have a problem."

That could involved remotely sending "pop-up" messages to infected computers or, in the case of a similar Trojan, NetBus, opening the computer user's CD-ROM drive.

She rejected the possibility that Garrett could have been using Back Orifice to gain publicity because the IT community generally had little respect for "these kiddies running around infecting people with Back Orifice."

Other defence witnesses called included Auckland IT manager Mark Foster, who raised questions about discrepancies between CD copies of the contents of Garrett's hard drive and information presented in forensic reports from the police.

Also giving evidence was Garrett's wife, Deborah Hooper, who said the Telecom phone line into the couple's home had their name and telephone number written on it, something that violated their privacy.

That claim was rejected by Crown prosecutors as irrelevant.

The testimony of the three defence witnesses followed a string of witnesses testifying for the Crown, including police forensic experts, former employees of Telecom and the internet account holders themselves.

The trial enters its final stages tomorrow with closing arguments from the defence and Crown.

Judge David Harvey will sum up on Monday.

Links

Cult of the Dead Cow

Undernet