January 2001 - cypherpunks-legacy

Re: Idea for tamper-resistant PC hardware
by mmotyka＠lsil.com 12 Jan '01

12 Jan '01

I guess if your critical server is simply some sort of service provider and the only data requiring security are the operating keys then your hostile location is OK since rebuilding a system and restoring a few keys ( which can be hidden just about anywhere ) is easily done. Otherwise the loss of the data could be costly. If your data is static then it would be relatively easy to stash a copy somewhere. If your data is dynamic then backups are necessary. Backups can be tracked to their resting place. So their location needs to be ( physically and legally ) secure from the threat(s). Unless you can readily hand carry the backups to the secure storage area it will need to be connected in which case you might as well locate your server there in the first place.

1 0

P.A.T.
by Mar�a Noche 12 Jan '01

12 Jan '01

Dear Sirs, We are a battery distributor company wide established in the Spanish territory and we are interested in marketing a portable Alcohol tester, accurate and lightweight, as the most important features. We will be very pleased if you could send by answering to this e-mail more information of your products, prices as well as pictures of them. Looking forward to hearing from you soon, M.Noche Sales Mgr. ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Antigen found W32/Hybris@m virus
by ANTIGEN_EXCHANGE 12 Jan '01

12 Jan '01

Antigen for Exchange found dwarf4you.exe infected with W32/Hybris@m virus. The file is currently Deleted. The message, "Snowhite and the Seven Dwarfs - The REAL story!", was sent from Hahaha and was discovered in IMC Queues\Inbound located at ITC/Corporate/EXCHANGE.

1 0

Antigen found W32/Hybris-B virus
by ANTIGEN_BAMBI 12 Jan '01

12 Jan '01

Antigen for Exchange found dwarf4you.exe infected with W32/Hybris-B virus. The file is currently Deleted. The message, "CDR: Snowhite and the Seven Dwarfs - The REAL story!", was sent from Hahaha and was discovered in IMC Queues\Inbound located at Cognex/Natick/BAMBI.

1 0

Snowhite and the Seven Dwarfs - The REAL story!
by Hahaha 12 Jan '01

12 Jan '01

Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter...

1 0

heavy handed feebs fuck 16 year old kid
by Blank Frank 12 Jan '01

12 Jan '01

Feds link boy, 16, and plot to 'take down Internet' Agents seize youth's computer equipment; family says it's all a misunderstanding Thursday, January 11, 2001 By SCOTT SUNDE SEATTLE POST-INTELLIGENCER REPORTER To the FBI, a Snohomish County teenager is a suspected cyberterrorist who planned to join others in unleashing a program that could "take down the Internet." Agents swooped in days before the program was to be tested, seizing computer equipment at the 16-year-old boy's home north of Lynnwood on Dec. 22. To the boy and his family, it's all a big misunderstanding. The FBI is making far too much of a little computer noodling and adolescent boasting, they say. "They got it totally wrong," the boy complained yesterday. An FBI spokesman said yesterday the agency is working closely with prosecutors and can say little about the international case. The FBI has made no arrests so far in the United States, said Matt McLaughlin, a spokesman at the bureau's Los Angeles office. The investigation began in October, according to documents used to obtain a warrant to search the youth's Alderwood Manor home. DALNet, a San Diego company that provides Internet chat networks, contacted the FBI and complained that several computer users had begun attacks on it. The hackers caused computers to become disabled and denied other users access to DALNet, according to an affidavit by John Pi, a computer expert and FBI agent in Los Angeles. Investigators traced the user names of the alleged hackers, leading them to the 16-year-old and computer users in California, Michigan and Israel. In an interview yesterday, the boy said he used DALNet but didn't attack it. When an administrator there accused him of attacks, he said he "flooded her with messages. That's not illegal." A DALNet systems operator told the FBI last fall that a person using the user name "Booterror" had created a program that could "take down the Internet on New Year's Eve," Pi wrote in the affidavit. Booterror planned to send test versions of the program to other computer users by Dec. 25, with the intent of then spreading it world-wide, according to Pi. "That's totally invalid," the 16-year-old said yesterday. The teen acknowledged that his computer nickname is Booterror but said it is pronounced "Boot-Error." "Boot" is a common computer term used when a system comes online. The FBI agents raiding his home made it sound more sinister -- pronouncing it "Boo-Terror," he said. He said he tried to create a "Trojan," a program that can be sent out and used to control someone's computer. But he folded the project two months ago, he said. "I was just playing around and learning something. I was just going to make a small Trojan, and I just got caught up in this." He started working with computers and surfing the Internet two years ago, he said. He built his own computers. The youth had been attending a community college to earn the equivalent of a high school diploma. But he hasn't shown much interest in that or much of anything else since the FBI paid a call, the boyfriend of the boy's mother said. He said the boy is guilty only of getting a little "mouthy" over the Internet. "He's just 16 years old. That's all it was -- bragging. He had no intention of doing all that crap." But federal authorities and DALNet are serious about the investigation. The company's Web page provided a link this week to news reports from Israel, where police arrested four 17-year-old hackers suspected of planning an attack on U.S. computer systems on New Year's Eve. DALNet said in a prepared statement that it is cooperating with the FBI and law enforcement outside the U.S. and "will continue to pursue all individuals responsible for attacks upon our systems." http://seattlep-i.nwsource.com/local/hack11.shtml

2 1

Idea for tamper-resistant PC hardware
by drevil＠sidereal.kz 12 Jan '01

12 Jan '01

Here's something I would like to see: a harddrive that is tamper-resistant. The threat model is a server is deployed in an untrusted machineroom, and recovery of plaintext from the system is unacceptable. One obvious attack, involving an encrypted hard drive, is for the attackers to have a "power failure" and then remove the encrypted hard drive from the server, and reinstall it in an "instrumented" server which can recover key data. I want to defeat that attack. One obvious way to do that would be to have a bunch of thermite, or explosives, or whatever that trigger when the thing is tampered with. That's fine, but as a general rule, if the solution to the problem requires explosives, I would rather try to find a different problem. So here's another solution. The hard drive itself is encrypted, and the encryption/decryption hardware is part of the hard drive chips, and all are mounted within a tamper-resistant enclosure. Also mounted in this enclosure is a little battery which will last for the lifetime of the harddrive, and a large-enough capacitor. When the enclosure is tampered with, the capacitor sends a jolt through the chip that holds the encryption key. This jolt is big enough to melt the silicon, so no key bits could be recovered (this would not require much of a jolt, I would think). Then the attacker would have the hard drive, but no way to decrypt it. Obviously, it would need sensors to detect tampering with the case, and tricks liking freezing the thing, using radiation, whatever. This allows us to have data be permenantly destroyed, and the hard drive permenantly deactivated, without doing any crazy stuff involving pyrotechnics which looks bad in the media. "The computer exploded, injuring the thieves" looks much worse than "The thieves tripped a safety mechanism and were unable to recover any data from the computer." It would also allow everyhting to be done in a normal-looking PC case. So the total solution would be a computer case with sensors which trigger the capacitor in the hard drive, and also sensors in the hard drive enclosure which trigger destruction of the key. It seems like this wouldn't be such a complicated thing to implement. Any thoughts on this?

2 1

SGBvsLei@aol.com
by Blank Frank 12 Jan '01

12 Jan '01

At 08:52 PM 1/11/01 -0500, SGBvsLei(a)aol.com wrote: >i saw ur name somewhere on a board,... u were talking about NORTON YOUR EYES >ONLY,.. i was wondering if u knew where i could get the US version or if u >could send,... thanx,... Soliciting to steal software? We've contacted the BSA and AOL. Expect a visit at home sometime soon. You *do* have licenses for what's on your hard drive, don't you? Chump.

1 0

As Dot-Coms Go Bust in the U.S., Bermuda Hosts a Little Boomlet
by mean-green＠hushmail.com 12 Jan '01

12 Jan '01

As Dot-Coms Go Bust in the U.S., Bermuda Hosts a Little Boomlet By MICHAEL ALLEN Staff Reporter of THE WALL STREET JOURNAL HAMILTON, Bermuda -- Operating out of a hurricane-proof command center in a former U.S. military base, Paven Bratch is a tax examiner's nightmare. Although his Internet company, music and video merchant Playcentric.com (www.playcentric.com1) has just 10 employees, didn't go live until September and has yet to turn a profit, it has the structure of a major multinational. Its computer servers are located here, its operating unit is in Barbados, and it has a distribution deal with a big record-store chain in Toronto. The 36-year-old Mr. Bratch figures this setup will save him so much on corporate income taxes and other expenses that he'll be able to undercut Amazon.com Inc.'s prices by more than 45% and still make a bundle. "One thing that always amazes me is, why would anyone who's planning on generating a profit locate themselves in a full-tax jurisdiction?" he says. 'First Generation' Plenty of dot-coms are asking themselves the same question these days. Undaunted by their industry's growing ranks of flameouts and hoping to emerge as one of the profitable few, dozens of them are popping up in tax havens around the world. In Bermuda, they range from tiny publisher ISI Publications Ltd., which sells hard-to-find business books under the domain name Booksonbiz.com (www.booksonbiz.com2) to E*Trade Group Inc., the big online stockbroker, which is locating its international trading operations here. Further south, on the Caribbean island of Antigua, an American trader has set up Indextrade.com (www.indextrade.com3) to allow small investors to bet on swings in market indexes, while in Cyprus, a former British jazz singer is doing a brisk business by listing vessels such as a Soviet-era submarine on Ships-for-sale.com (www.ships-for-sale.com4) "These merchants are the first generation who can really domicile anywhere, " says Andrea Wilson, chief executive of Bermuda-based First Atlantic Commerce Ltd. (www.firstatlanticcommerce.com5) which provides credit-card payment systems for e-businesses. "They can be a virtual corporation if they choose." The trend started with Internet gambling companies, which fled to the Caribbean to avoid the long arm of U.S. law. But now, thanks to an explosion of new telecommunications links to places such as Bermuda and Britain's Channel Islands -- and an ambitious push by promoters in such countries as Panama to set up facilities capable of hosting hundreds or thousands of Web sites each -- more-legitimate Internet companies are starting to make the leap offshore. A Wealth of Ambiguity There are serious questions about whether some of the structures would pass muster with the Internal Revenue Service and its foreign counterparts. But many accountants figure there's enough ambiguity in the industrial world's offshore tax codes that e-commerce companies could, at least theoretically, rack up tax-free profits for years before the authorities sort things out. The issues are often murkier than for a standard offshore tax shelter, because they involve technological innovations that the U.S. Treasury couldn't have anticipated when it began laying the ground rules for offshore taxation in the 1960s. For instance, nobody's entirely sure how to tax the earnings of a programmer who sells his software by allowing buyers to download it from a Web site hosted on a computer server in a zero-tax jurisdiction. Some tax attorneys take the position that the sale takes place where the server is located, and that the business owes no corporate or sales tax in the buyer's home country. "It would be no different than you or I getting on a plane, flying to the Bahamas, and buying a T-shirt in the hotel," says Lazaro Mur, a Miami tax attorney. New telecommunications options have brought Bermuda and much of the Caribbean even closer than a plane ride away. Cable & Wireless PLC's phone monopoly among former British colonies in the region is breaking up, and C&W's new competitors are starting to lace the seabed with modern fiber-optic lines, breaking down old technological barriers to working offshore. At the same time, so-called server farms -- warehouses built to accommodate row upon row of computer servers -- are sprouting up to accommodate high- tech newcomers. At Fort Clayton, a former U.S. military base in Panama, local entrepreneurs plan to open a 50,000-square-foot "high-tech hotel" later this month they say will be capable of hosting as many as 1.2 million Web sites. HavenCo, a self-proclaimed "data haven," announced plans last year to host Web sites from an antiaircraft platform abandoned by the British after World War II. The North Sea platform has a colorful history: In 1966, a retired British army major seized control of it and has operated it for years as the sovereign "Principality of Sealand." Ryan Lackey, HavenCo's chief technical officer, says the company, which spent the summer upgrading electrical power and air conditioning on Sealand, has more than 30 servers up and running, connected to the mainland by satellite and wireless service, and hopes to expand to as many as 5,000. He says the company has fielded "several thousand" sales inquiries. "The big thing people really want is e-mail servers, because in the past people have been getting their e-mail servers subpoenaed," he says. He adds that HavenCo would only comply with subpoenas issued by the Court of Sealand. "But there's no Court of Sealand, so it's very unlikely." Tax savings are the big selling point for many of the installations. "Offshore + Ecommerce=Tax Free Heaven," screams a banner ad for Bahamas.net, which offers server facilities in the Bahamas for as low as $2,200 a month. Bermuda, which has a rich history of helping foreigners shave taxes, also is doing its best to encourage the migration offshore. Its two biggest banks, Bank of Bermuda Ltd. and Bank of N.T. Butterfield & Son Ltd., have launched major e-commerce initiatives, establishing systems to allow online merchants to bill customers in several major currencies. A common refrain among business leaders on this tiny fishhook-shaped island is that Bill Gates would be a much-richer man today if he had originally established Microsoft here. The pitch helped reel in Robert Edwards, an editorial cartoonist who lives in Canterbury, England. Not long ago he went looking for help in setting up a Web site to sell works by him and about 30 other artists from around the world. Tipped off to Bermuda by a visiting delegation of businesspeople, he registered his company online through Appleby, Spurling & Kempe, a local law firm here, and was quickly directed to Web designers, a hosting site and a credit-card intermediary, First Atlantic. Late last year, at a total cost of less than $200,000, his Drawnandquartered.com (www.drawnandquartered.com6) went live, offering 4,000 artworks, which can be downloaded online with a credit card, for $200 and up. His company doesn't pay any income or sales taxes, and he only has to pay personal-income tax on the salary he draws. "I'm a perfect example of how it can be done," he says. Playcentric's Mr. Bratch, a former Procter & Gamble Co. manager, says he relied on advice from an international tax attorney in structuring the online retailer, which will market its compact disks, videos and DVDs partly through packaged-goods makers who want to reward loyal customers. Mr. Bratch, a Canadian citizen, put his operating unit in Barbados, which, unlike Bermuda, has a tax treaty with Canada, in order to take advantage of the Caribbean nation's corporate income-tax rate of just 2%. He says he located his computer operations in Bermuda because of its extensive banking and telecommunications infrastructure. Its attractions include a state-of-the-art server facility built in an old U.S. naval base by 360networks Inc.'s TeleBermuda International unit, which laid an undersea fiber-optic cable to the U.S. in 1997. Tax considerations also helped lure Todd Middagh, chief executive of Originals Online Ltd., to Bermuda. His brainchild: a site that will allow importers, exporters and shipping companies to swap legally binding trade documents online, instead of wasting days with couriers. "It's a digital product, global in nature, 24-hours-a-day world-wide," says Mr. Middagh, who has already attracted the interest of several major grain companies, including Archer Daniels Midland Co. "We're going to be in almost every jurisdiction over time," he says. Meanwhile, Mr. Middagh, a native of Canada, will be presiding over the company from his house here, which overlooks the Atlantic Ocean. Scott Rubman, a Long Island, N.Y., real-estate attorney whose family has long been in the fur trade, is putting together Furs.com (www.furs.com7) a Bermuda-based site that plans to match mink farmers in, say, Norway, with fur-coat manufacturers in North America and China. As an American, Mr. Rubman may face a bigger hurdle in shielding any offshore profits from taxation. Unlike many other countries, the U.S. taxes its citizens on their income world-wide. "If you move offshore strictly to evade taxes, that's something the U.S. will always look at," says Mr. Rubman, who is getting plenty of advice from U.S. tax experts. "When you have a legitimate business purpose to transact business offshore, I'd think the U.S. would be supportive of that." And if the U.S. isn't supportive? Cryptographer Vince Cate thinks he has that covered. In 1998, the onetime Carnegie-Mellon University Ph.D candidate walked into the U.S. Embassy in Barbados and renounced his American citizenship, declaring that he was henceforth a citizen of Mozambique, thanks to a document he purchased for $5,000 over the Internet. Then, he went back to the Caribbean island of Anguilla, where he had developed a reputation as a computer-encryption visionary. Among his many ventures, he has taken over the operations of an online marketer of driver's-license information that had run afoul of a new privacy law in Texas. Mr. Cate plans to build the business without paying a cent of taxes. "Because I'm not a U.S. citizen, I'm not in the United States, and Anguilla has no taxes, I don't believe I have any problem," he says. Write to Michael Allen at mike.allen(a)wsj.com8

13 22

DoJ publishes cybercrime manual, how much power cops have
by Declan McCullagh 12 Jan '01

12 Jan '01

******* See: http://www.cybercrime.gov/searchmanual.htm ******* http://www.wired.com/news/politics/0,1283,41133,00.html The Feds'll Come A-Snoopin' by Declan McCullagh (declan(a)wired.com) 2:00 a.m. Jan. 12, 2001 PST WASHINGTON -- Ever wonder how much leeway federal agents have when snooping through your e-mail or computer files? The short answer: a lot. The U.S. Department of Justice this week published new guidelines for police and prosecutors in cases involving computer crimes. The 500 KB document includes a bevy of recent court cases and covers new topics such as encryption, PDAs and secret searches. It updates a 1994 manual, which the Electronic Privacy Information Center had to file a Freedom of Information Act request to obtain. No need to take such drastic steps this time: The Justice Department has placed the report on its cybercrime.gov site. PAGERS VS. PDAs: Anyone who's arrested will likely be patted down for guns, contraband and electronic devices. So be sure to yank the batteries if you're about to be nabbed. During an arrest, cops can scroll through the information on your pager without a warrant. What about PDAs? The latest word, oddly enough, might be a 1973 Supreme Court case, United States v. Robinson, that permitted police officers to conduct searches of an arrestee's possessions. Lower courts have extended this rule to include pagers. But PDAs more closely resemble computers in processing speed and storage capacity. Concludes the DOJ: "Courts have not yet addressed whether Robinson will permit warrantless searches of electronic storage devices that contain more information than pagers. If agents can examine the contents of wallets, address books and briefcases without a warrant, it could be argued that they should be able to search their electronic counterparts (such as electronic organizers, floppy disks and Palm Pilots) as well." Not everyone agrees that an arrest can lead to a full search. "The search incident to arrest is less settled," says Jennifer Granick, a San Francisco attorney specializing in computer crime law. [...] "NO KNOCK" SEARCHES: Conservative activists may hate this, but "no knock" searches, where Kevlar-clad goons toting M-16s break through your front door without warning, aren't going away. If anything, the Justice Department seems to think they're even more necessary when dealing with computer crimes. "Technically adept computer hackers have been known to use 'hot keys,' computer programs that destroy evidence when a special button is pressed. If agents knock at the door to announce their search, the suspect can simply press the button and activate the program to destroy the evidence," the manual says. It doesn't end there: The Justice Department cites a 1997 case, Richards v. Wisconsin, in which the Supreme Court said agents can conduct a no knock search even if the judge granting the warrant didn't approve one. That's allowed when agents have a "reasonable suspicion" that the subject of the search could destroy evidence or obstruct the investigation. [...]

1 0