Hacker dips into The WELL

The WELL, one of the world's most famous online communities, has once again come under attack by a cracker who stole passwords, deleted an account and other files, and planted Trojan horses on the network, CNET has learned.

The WELL discovered earlier this week that someone had been messing around in its system, probably over the course of several months. The WELL says there is no evidence that the cracker read or sent personal mail or had access to credit card information. But he or she has still caused plenty of trouble for the WELL's administrators, and the company can't say for sure if the hacker is now locked out.

"This has been one of the more difficult security investigations we've had to deal with in the last several years," said The WELL president Maria Wilhelm, in a posting to members.

The WELL has earned a reputation as an elite cyberspace community and the electronic home to some of the best-known digerati of the Internet age. Howard Rheingold, for instance, based his widely read book Virtual Community from experiences on The WELL.

While people try to break into systems every day, break-ins into the WELL have garnered extra attention since the infamous Kevin Mitnick cracked the system and used it as a hacking home base before his capture in 1995.

The WELL spent many months calming its members and repairing the damage to its credibility after Mitnick's activities came to light. Now, the community is faced with another clean-up job.

The staff has had to spend hours trying to repair the damage and clear out the Trojan horses--small programs that can be used to attack computers, but unlike viruses, can't spread from computer to computer by replicating themselves. The community is also sending out an alert to all 11,000 or so members to change their passwords immediately, even though members are encouraged to do that every month, according to Gail Williams, director of conferencing.

"It takes a lot of time to clean up after these incidents," she said.

While the irony of cyberspace's most elite community being hacked gains extra media attention for The WELL's security problems, it is far from the only target of intruders.

While there are laws on the books to prosecute hackers and the FBI has special agents trained to electronically pursue them, only 17 percent of all computer attacks are reported to law enforcement agencies, said George Grotz, an FBI special agent in San Francisco, citing a recent study.

Whether hackers break into systems to steal real information or simply to vandalize a site for the sheer pleasure of it is a subject of debate.

In this case, there is no evidence that the cracker gained anything tangible. "I don't understand what the appeal is, frankly, of any of the attempts to crack our site," Williams said. "What these guys attempt to do is sneak in and play around in the basement and switch the wires. What I don't understand is why they don't come in to the system and participate in the party because it's so good online."

"This is just like someone walking into a magical garden and not being able to experience it as a magical garden," she added. "It's really missing the whole point."

While The WELL has been forthright with its members about this security breach, many companies are reluctant to come forward because "they have a legitimate and quite understandable concern as to how this would be viewed by the stockholders," Grotz said.

Online services who admit their security has been breached come under intense scrutiny from their subscribers. But some say the only way to create a completely impenetrable system would be to cut off any connections to the outside world.

"We in law enforcement have tried very hard to put the word out that we want to work in a partnership of private industry and develop these cases for prosecution without looking at a downside to stockholders. The secret is finding that middle ground where all interests are protected," said Grotz.

But The WELL would like to see the responsible parties stuck with the bill for cleaning up the electronic mess.

"It would be interesting if the courts could make people pay for all of the hours it took in cleaning up after them and compensating the users for the disruption," Williams said.