To More Security Information
The Third Letter was written by Jeffrey L. Paden
who ownes Modem Madness ISP in Jamestown NY
Statement on behalf of Franklin Werren
On or about September 15, 1998, Franklin Werren called me to say that he had discovered on the CECOMET.NET Internet site the file of subscriber passwords. He was concerned about finding this kind of information "in the open" and not in a secure location. He expressed concern about subscribers, especially the individual for whom he maintains web sites, that this information so easily available could compromise personal information and allows "hackers" access to personal email and web sites.
Franklin asked me what he should do and I first suggested he should forget that he found the information. But, listening to his concerns about his family, friends, and customers who subscribe to CECOMET internet services; we concluded that he should tell his customers, family, and friends only that he has some concerns about the security of the CECOMET system and to not be specific. As far as notifying CECOMET of their security problem, we discussed the fact that when he had presented ideas or concerns before, they were received negatively, and that he should not notify CECOMET of his discovery. He and I realized that this discovery could lead to problems for him if CECOMET decided to make him the scapegoat for their security problems.
Since this incident, CECOMET filed a complaint with the district attorney and criminal charges are pending against Mr. Werren -- a situation he and I both feared might happen. My computer competency is a great deal below Mr. Werren's; yet even as a novice, I could easily find the information he discovered. With that information I could send and receive email in the name of any of the subscribers, and I could post anything I wanted to on the web sites of subscribers. Mr. Werren's concerns are valid and this is a serious security oversight of the CECOMET system manager.
Mr. Werren did not break into the CECOMET system; he was a subscriber and logged on using his own password. The information he discovered was (and perhaps still is) available to anyone with authorized access to the system (and certainly to any "hackers"). The important aspect of this situation is that Mr. Werren DISCOVERED restricted files, but he did not COMPROMISE the files by disclosing or using the information.
Eldwin M. Lovelady December 9, 1998
Westfield, NY
Statement concerning charges against Franklin Werren
On October 7, 1998, at approximately 3:00 PM, I was present during the execution of a search warrant and seizure of computer equipment by the Chautauqua Country Sheriff's department and Chautauqua County District Attorney's office, from the home of Franklin Werren, in the town of Westfield, New York.
The Sheriff's Department investigator insisted that Mr. Werren accompany them to their office in Mayville to make a statement regarding the complaint filed against him by Chautauqua and Erie Telephone Company. I was in the outer room of Mr. Werren's workshop, in a position to overhear the conversation, while the Sheriff's deputy and investigator were collecting Mr. Werren's equipment and when they advised Mr. Werren that he needed to accompany them. I do not believe that Mr. Werren was advised of his rights and asked if he understood his rights while still at his residence, or any time prior to him making a written statement in the Investigator's office in Mayville.
I drove Mr. Werren to the Sheriff's Office in Mayville and waited while he made the statement. During the process of obtaining the statement I was outside the closed office door and unable to hear most of the conversation. I understand that the statement he gave and signed has a paragraph stating that he understood his rights and willingly make the statement. I believe he understood, as I did, that the situation was only an investigation and the statement he made would not be a document on which criminal charges against him would be based. The investigators told him, and me, that it was likely that his statement would clear up the matter and that they did not feel that charges would be filed.
Eldwin M. Lovelady
22 First Street
Westfield, New York
December 3, 1998
To Whom It May Concern:
I am the owner of Modem Madness BBS and Internet Service. It has been brought
to my attention that a great injustice has been brought against Frank Werren. I
would hope that if one of my customers found a security problem with our system
that they would be as kind to us a Frank was to C.E. Comet and let us known about
the problem so that we could fix it quickly.
When a customer of ANY ISP has a web page, he/she has access to an FTP server so
that they can upload their web pages any time they want to. As an ISP it is our job to
make sure that each user has a SECURE place to upload their pages not only to
protect that user but to protect the integerty of the system as a whole. Frank found
that when logged into the FTP server for C. E. Comet he had not only access to his
directory but could also select an option to move back a directory or two which gave
him access to confidential files. This is a VERY large problem for any ISP and at
that time if Frank wanted to he could have deleted any of those files which would
have crippled C. E. Comet. Instead he called them and told them about this problem
only to be thanked by having his access removed and charges brought against him for
a crime he did NOT commit.
Frank came to me at the time it happened and asked my advise and I told him at
that time not to worry about it since there is not a court on the face of the planet that
would not see the simple fact that he was being punished for helping his ISP. I guess
I was wrong since this case has moved forward. The only reason I could think of for
this that the lawyers involved do not understand how an ISP works and exactly what
took place. If anyone should have charges against them should be C. E. Comet for
allowing confidential files to be accessed by any user that logged into their ftp server.
As an ISP owner I will be happy to explain to anyone that wants information just
exactly how this could happen and why there is NO CASE against Frank Werren in
this matter. Please feel free to contact me for more information before this great
injustice gets any futher out of hand.
Sincerely,
(sig)
Jeff Paden
Proprietor
As of December 12, 2001 Comet Again changed there server to
a Solaris 8 Based Server
Apache/1.3.22 (Unix) PHP/4.0.6 mod_gzip/1.3.19.1a
mod_ssl/2.8.5 OpenSSL/0.9.6b
No Change was done to their users www2 home page server.
October 2003
After checking some trace routes,
C&E appears to be using a dual home backbone system.
All this info is freely available off the net
What's that site running? |
My @bagpipes.net e-mail was Banned from Comet,
The e-mail ban was lifted at CE Comet 12/1/99
Several other ISP's and a number of Domains
that was hosted by www.pcom.net was causing
me problems at times communicating with some of my customers.
This e-mail ban was started about November 1, 1998
DATED: July 9, 2002
Info that I finally obtained shows the parent company
is FairPoint Communications at www.fairpoint.com
They have a list of all their holding companies on there main site.
You will also see a Search Result at the PSC about Fairpoint
As well as this Search Result and this Search Result
This search result was on Taconic.
I also found this on
MJD Communications, Inc., MJD Holdings Corp., MJD Ventures, Inc
at the PSC dated from 1997
CE Comet Users Page I Still Maintain at my Main Site
FTP User Info on Comet I posted at My Main Site
 |
 |
 |
Please report any problems with this site to: webmaster@bagpipes.net