June 2002 - cypherpunks-legacy

Insight on the News Email Edition
by Insight on the News 27 Jun '02

27 Jun '02

INSIGHT NEWS ALERT! A new issue of Insight on the News is now online http://www.insightmag.com ............................................... Folks, in case you missed it, John Berlau’s blockbuster on how anti- tobacco lawyers are now targeting fast food is still posted http://www.insightmag.com/news/256297.html. And Hans Nichols sweeps the dirt on the Ninth Circuit Court out from under the carpet, and explains how it could have done the unthinkable---rule the Pledge of Allegiance unconstitutional http://www.insightmag.com/news/256762.html. I know you’ll enjoy them! OK, until next time, from the Bunker, I’m your newsman in Washington. ............................................... ONE NATION, UNDER THE NINTH CIRCUIT Hans Nichols says they ruled the Pledge of Allegiance unconstitutional. Read more about this "Rogue Court." http://www.insightmag.com/news/256762.html ............................................... SUPPLYING TERRORISTS THE ‘OXYGEN OF PUBLICITY’ Jamie Dettmer opines that combating terrorism is a desperate undertaking for any democratic government. Fight with merely military might and the struggle can be lost — as the Reagan administration belatedly learned in Central America in the 1980s and the Russians have found in Chechnya. http://www.insightmag.com/news/256316.html ............................................... A BURNING ISSUE Phil Magers writes that Arizona and Colorado burn the wildland fire management debate rages. http://www.insightmag.com/news/256498.html ======================================== Be Your Own Boss!! No Selling. . . No Overhead. . . Immediate Cash Flow. . .Start Now http://etools.ncol.com/a/jgroup/bg_GCOA_wwwinsightmagcom_14.html ======================================== UNLIKE CLINTON, BUSH IS MEETING THE THREAT OF TERRORISM Ralph Reiland writes that like three blind mice, House Majority Leader Dick Gephardt, Sen. Hillary Rodham Clinton and Democratic political strategist James Carville are running around saying they want their eyes opened as to what's going on in this country about terrorism. http://www.insightmag.com/news/256332.html ............................................... SYMPOSIUM---PRO & CON Q: Has the White House ignored human rights in the name of national security? http://www.insightmag.com/news/256338.html WILLIAM SCHULZ SAYS: YES: The administration has given itself and its coalition partners a 'pass' on human-rights violations. http://www.insightmag.com/news/256339.html ROBERT L. MAGINNIS SAYS: NO: It is not treating suspected terrorists inhumanely nor trampling on the civil rights of citizens. America's global war on terrorism significantly will advance human rights because it will free people from repression and the threat of terrorism. Until the war is over, however, expect temporary sacrifices for more security. Every soldier facing the enemy understands this unavoidable trade-off. http://www.insightmag.com/news/256340.html .............................................. BIZARRE RULING—NO REGULATION NEEDED Sean Paige tells us, in what well could be a first, a leading government agency with responsibility for public safety has recommended against heaping yet another safety mandate on the mountain of regulations already in place to ensure that accidents don't happen. http://www.insightmag.com/news/256330.html ======================================== SUBSCRIBE TO THE INSIGHT PRINT EDITION TODAY! And Save 72% (Off Our Newsstand Price) https://www.collegepublisher.com/insightsub/subform1.cfm ======================================= You have received this newsletter because you have a user name and password at Insight on the News. To unsubscribe from this newsletter, visit "http://www.insightmag.com/main.cfm?include=unsubscribe". You may also log into Insight on the News and edit your account preferences on the Web. If you have forgotten or don't know your user name and password, it will be emailed to you after visiting the following link: http://www.insightmag.com/main.cfm?include=emailPassword&serialNumber=16oai…

1 0

Two additional TCPA/Palladium plays
by Lucky Green 27 Jun '02

27 Jun '02

[Minor plug: I am scheduled to give a talk on TCPA at this year's DEF CON security conference. I promise it will be an interesting talk. http://www.defcon.org ] Below are two more additional TCPA plays that I am in a position to mention: 1) Permanently lock out competitors from your file formats. >From Steven Levy's article: "A more interesting possibility is that Palladium could help introduce DRM to business and just plain people. It's a funny thing," says Bill Gates. "We came at this thinking about music, but then we realized that e-mail and documents were far more interesting domains." Here it is why it is a more interesting possibility to Microsoft for Palladium to help introduce DRM to business and "just plain people" than to solely utilize DRM to prevent copying of digital entertainment content: It is true that Microsoft, Intel, and other key TCPA members consider DRM an enabler of the PC as the hub of the future home entertainment network. As Ross pointed out, by adding DRM to the platform, Microsoft and Intel, are able to grow the market for the platform. However, this alone does little to enhance Microsoft's already sizable existing core business. As Bill Gates stated, Microsoft plans to wrap their entire set of file formats with DRM. How does this help Microsoft's core business? Very simple: enabling DRM for MS Word documents makes it illegal under the DMCA to create competing software that can read or otherwise process the application's file format without the application vendor's permission. Future maintainers of open source office suites will be faced with a very simple choice: don't enable the software to read Microsoft's file formats or go to jail. Anyone who doubts that such a thing could happen is encouraged to familiarize themselves with the case of Dmitry Skylarov, who was arrested after last year's DEF CON conference for creating software that permitted processing of a DRM-wrapped document file format. Permanently locking out competition is a feature that of course does not just appeal to Microsoft alone. A great many dominant application vendors are looking forward to locking out their competition. The beauty of this play is that the application vendors themselves never need to make that call to the FBI themselves and incur the resultant backlash from the public that Adobe experienced in the Skylarov case. The content providers or some of those utilizing the ubiquitously supported DRM features will eagerly make that call instead. In one fell swoop, application vendors, such as Microsoft and many others, create a situation in which the full force of the U.S. judicial system can be brought to bear on anyone attempting to compete with a dominant application vendor. This is one of the several ways in which TCPA enables stifling competition. The above is one of the near to medium objectives the TCPA helps meet. [The short-term core application objective is of course to ensure payment for any and all copies of your application out there]. Below is a mid to long term objective: 2) Lock documents to application licensing As the Levy article mentions, Palladium will permit the creation of documents with a given lifetime. This feature by necessity requires a secure clock, not just at the desktop of the creator of the document, but also on the desktops of all parties that might in the future read such documents. Since PC's do not ship with secure clocks that the owner of the PC is unable to alter and since the TCPA's specs do not mandate such an expensive hardware solution, any implementation of limited lifetime documents must by necessity obtain the time elsewhere. The obvious source for secure time is a TPM authenticated time server that distributes the time over the Internet. In other words, Palladium and other TCPA-based applications will require at least occasional Internet access to operate. It is during such mandatory Internet access that licensing-related information will be pushed to the desktop. One such set of information would be blacklists of widely-distributed pirated copies of application software (you don't need TCPA for this feature if the user downloads and installs periodic software updates, but the user may choose to live with application bugs that are fixed in the update rather than see her unpaid software disabled). With TCPA and DRM on all documents, the application vendor's powers increase vastly: the application vendor can now not just invalidate copies of applications for failure to pay ongoing licensing fees, but can invalidate all documents that were ever created with the help of this application. Regardless how widely the documents may have been distributed or on who's computer the documents may reside at present. Furthermore, this feature enables world-wide remote invalidation of a document file for reasons other than failure to pay ongoing licensing fees to the application vendor. To give just one example, documents can be remotely invalidated pursuant to a court order, as might be given if the author of the document were to distribute DeCSS v3 or Scientology scriptures in the future DRM protected format. All that is required to perform such an administrative invalidation of a document is either a sample copy of the document from which one can obtain its globally unique ID, the serial number of the application that created the document, or the public key of the person who licensed the application. (Other ways to exist but are omitted in the interest of brevity). --Lucky Green

1 0

(Fwd) Nortel secret security part of court records now, gracia
by Iggy River 27 Jun '02

27 Jun '02

I looked at the Nevada PUC (PUCN) web site and found that the most recent document on-line that relates to docket #{HYPERLINK "dkt_00-6057/00-6057.htm"}00-6057 (EDDIE MUNOZ VS CENTRAL TELEPHONE COMPANY-NEVADA DBA SPRINT OF NEVADA, COMPLAINT ALLEGING INCOMING CALLS ARE BEING BLOCKED OR DIVERTED FROM CUSTOMERS BUSINESS) is from 04/07/02 - and the link is broken. Clearly the below referenced document (Nortel codes) will not appear on-line -- at least not courtesy of the PUCN. However, chapter 703, "PUBLIC UTILITIES COMMISSION OF NEVADA - GENERAL PROVISIONS", of the Nevada Revised Statues states) among other things): NRS 703.190 Records open to public inspection; exception. 1. Except as otherwise provided in this section, all biennial reports, records, proceedings, papers and files of the commission must be open at all reasonable times to the public. 2. The commission shall, upon receipt of a request from a public utility, prohibit the disclosure of any information in its possession concerning the public utility if the commission determines that the information would otherwise be entitled to protection as a trade secret or confidential commercial information pursuant to {HYPERLINK "NRS-049.html" \l "NRS049Sec325"}NRS 49.325 or {HYPERLINK "NRS-600A.html" \l "NRS600ASec070"}600A.070 or Rule 26(c)(7) of the Nevada Rules of Civil Procedure. Upon making such a determination, the commission shall establish the period during which the information must not be disclosed and a procedure for protecting the information during and after that period. [Part 12:109:1919; 1919 RL p. 3157; NCL ' 6111](NRS A 1995, 385) I don't know what the legal definition of "confidential commercial information" is, but I doubt that the code list could be construed as a trade secret *of the utility*, perhaps of Nortel, but according to the statute only the utility can move to limit public access to the documents. Perhaps this document is currently accessible in hard copy in NV? I wonder how many people have visited the PUCN office in the past three days! ------- Forwarded message follows ------- Date sent: Wed, 26 Jun 2002 09:23:14 -0700 From: "Major Variola (ret)" <mv(a)cdc.gov> Subject: Nortel secret security part of court records now, gracias Kevin To: undisclosed-recipients: ; Towards the bottom of this article its mentioned that Mitnick submitted a list of Nortel's [1] 'security' barriers to r00t [2] on a widely used piece of telco switching equiptment. One wonders how many copies of this info circulate in TLA's technical intercept depts? [1] (presumably obsolete :-) [2] Should this be called "tapr00t" ?? ---------- http://online.securityfocus.com/news/497 Mitnick Testifies Against Sprint in Vice Hack Case The ex-hacker details his past control of Las Vegas' telecom network, and raids his old storage locker to produce the evidence. By Kevin Poulsen, Jun 24 2002 11:25PM LAS VEGAS--Since adult entertainment operator Eddie Munoz first told state regulators in 1994 that mercenary hackers were crippling his business by diverting, monitoring and blocking his phone calls, officials at local telephone company Sprint of Nevada have maintained that, as far as they know, their systems have never suffered a single intrusion. The Sprint subsidiary lost that innocence Monday when convicted hacker Kevin Mitnick shook up a hearing on the call-tampering allegations by detailing years of his own illicit control of the company's Las Vegas switching systems, and the workings of a computerized testing system that he says allows silent monitoring of any phone line served by the incumbent telco. "I had access to most, if not all, of the switches in Las Vegas," testified Mitnick, at a hearing of Nevada's Public Utilities Commission (PUC). "I had the same privileges as a Northern Telecom technician." Mitnick's testimony played out like a surreal Lewis Carroll version of a hacker trial -- with Mitnick calmly and methodically explaining under oath how he illegally cracked Sprint of Nevada's network, while the attorney for the victim company attacked his testimony, effectively accusing the ex-hacker of being innocent. The plaintiff in the case, Munoz, 43, is accusing Sprint of negligence in allegedly allowing hackers to control their network to the benefit of a few crooked businesses. Munoz is the publisher of an adult advertising paper that sells the services of a bevy of in-room entertainers, whose phone numbers are supposed to ring to Munoz's switchboard. Instead, callers frequently get false busy signals, or reach silence, Munoz claims. Occasionally calls appear to be rerouted directly to a competitor. Munoz's complaints have been echoed by other outcall service operators, bail bondsmen and private investigators -- some of whom appeared at two days of hearings in March to testify for Munoz against Sprint. Mitnick returned to the hearing room clutching a crumpled, dog-eared and torn sheet of paper. Munoz hired Mitnick as a technical consultant in his case last year, after SecurityFocus Online reported that the ex-hacker -- a onetime Las Vegas resident -- claimed he had substantial access to Sprint's network up until his 1995 arrest. After running some preliminary tests, Mitnick withdrew from the case when Munoz fell behind in paying his consulting fees. On the last day of the March hearings, commissioner Adriana Escobar Chanos adjourned the matter to allow Munoz time to persuade Mitnick to testify, a feat Munoz pulled-off just in time for Monday's hearing. Mitnick admitted that his testing produced no evidence that Munoz is experiencing call diversion or blocking. But his testimony casts doubt on Sprint's contention that such tampering is unlikely, or impossible. With the five year statute of limitations long expired, Mitnick appeared comfortable describing with great specificity how he first gained access to Sprint's systems while living in Las Vegas in late 1992 or early 1993, and then maintained that access while a fugitive. Mitnick testified that he could connect to the control consoles -- quaintly called "visual display units" -- on each of Vegas' DMS-100 switching systems through dial-up modems intended to allow the switches to be serviced remotely by the company that makes them, Ontario-based Northern Telecom, renamed in 1999 to Nortel Networks. Each switch had a secret phone number, and a default username and password, he said. He obtained the phone numbers and passwords from Sprint employees by posing as a Nortel technician, and used the same ploy every time he needed to use the dial-ups, which were inaccessible by default. With access to the switches, Mitnick could establish, change, redirect or disconnect phone lines at will, he said. That's a far cry from the unassailable system portrayed at the March hearings, when former company security investigator Larry Hill -- who retired from Sprint in 2000 -- testified "to my knowledge there's no way that a computer hacker could get into our systems." Similarly, a May 2001 filing by Scott Collins of Sprint's regulatory affairs department said that to the company's knowledge Sprint's network had "never been penetrated or compromised by so-called computer hackers." Under cross examination Monday by PUC staff attorney Louise Uttinger, Collins admitted that Sprint maintains dial-up modems to allow Nortel remote access to their switches, but insisted that Sprint had improved security on those lines since 1995, even without knowing they'd been compromised before. But Mitnick had more than just switches up his sleeve Monday. The ex-hacker also discussed a testing system called CALRS (pronounced "callers"), the Centralized Automated Loop Reporting System. Mitnick first described CALRS to SecurityFocus Online last year as a system that allows Las Vegas phone company workers to run tests on customer lines from a central location. It consists of a handful of client computers, and remote servers attached to each of Sprint's DMS-100 switches. Mitnick testified Monday that the remote servers were accessible through 300 baud dial-up modems, guarded by a technique only slightly more secure than simple password protection: the server required the client -- normally a computer program -- to give the proper response to any of 100 randomly chosen challenges. The ex-hacker said he was able to learn the Las Vegas dial-up numbers by conning Sprint workers, and he obtained the "seed list" of challenges and responses by using his social engineering skills on Nortel, which manufactures and sells the system. The system allows users to silently monitor phone lines, or originate calls on other people's lines, Mitnick said. Mitnick's claims seemed to inspire skepticism in the PUC's technical advisor, who asked the ex-hacker, shortly before the hearing was to break for lunch, if he could prove that he had cracked Sprint's network. Mitnick said he would try. Two hours later, Mitnick returned to the hearing room clutching a crumpled, dog-eared and torn sheet of paper, and a small stack of copies for the commissioner, lawyers, and staff. At the top of the paper was printed "3703-03 Remote Access Password List." A column listed 100 "seeds", numbered "00" through "99," corresponding to a column of four digit hexadecimal "passwords," like "d4d5" and "1554." Commissioner Escobar Chanos accepted the list as an exhibit over the objections of Sprint attorney Patrick Riley, who complained that it hadn't been provided to the company in discovery. Mitnick retook the stand and explained that he used the lunch break to visit a nearby storage locker that he'd rented on a long-term basis years ago, before his arrest. "I wasn't sure if I had it in that storage locker," said Mitnick. "I hadn't been there in seven years." "If the system is still in place, and they haven't changed the seed list, you could use this to get access to CALRS," Mitnick testified. "The system would allow you to wiretap a line, or seize dial tone." Mitnick's return to the hearing room with the list generated a flurry of activity at Sprint's table; Ann Pongracz, the company's general counsel, and another Sprint employee strode quickly from the room -- Pongracz already dialing on a cell phone while she walked. Riley continued his cross examination of Mitnick, suggesting, again, that the ex-hacker may have made the whole thing up. "The only way I know that this is a Nortel document is to take you at your word, correct?," asked Riley. "How do we know that you're not social engineering us now?" Mitnick suggested calmly that Sprint try the list out, or check it with Nortel. Nortel could not be reached for comment after hours Monday. The PUC hearing is expected to run through Tuesday. ------- End of forwarded message -------

1 0

Mailman results for Uk_members
by uk_members-request＠inseadalumni.org 27 Jun '02

27 Jun '02

This is an automated response. There were problems with the email commands you sent to Mailman via the administrative address <uk_members-request(a)inseadalumni.org>. To obtain instructions on valid Mailman email commands, send email to <uk_members-request(a)inseadalumni.org> with the word "help" in the subject line or in the body of the message. If you want to reach the human being that manages this mailing list, please send your message to <uk_members-admin(a)inseadalumni.org>. The following is a detailed description of the problems. ***** unsubscribe >>>>> Usage: unsubscribe <password> [<email-address>] Command? This is a request to remove a bogus subscription in which ... Command? is sending its mail to the cypherpunks mailing list. Command? Please remove the address: cypherpunks(a)ssz.com Command? from your list. >>>>> >>>>> Too many errors encountered; the rest of the message is ignored: > Any questions, please email me at lwp(a)mail.msen.com. >

1 0

Urgent Reply.
by Tinimbu Frank. 27 Jun '02

27 Jun '02

REQUEST FOR URGENT BUSINESS RELATIONSHIP. THE PRESIDENT CEO, First,I must solicit your strictest confidentiality in this transaction.This is by virtue of its nature as being utterly confidential and 'top secret'. You have been recommended by an associate who assured me in confidence of your ability and reliability to prosecute a transaction of great magnitude involvinga pending business transaction requiring maximum confidence. We are top officials of the Federal Government Contract Review Panel who are interested in importation of goods into our country with fundswhich are presently trapped in Nigeria. In order tocommence this business we solicit your assistance to enable us transfer into your account the said trapped funds. The source of the fund is as follows: During the last Military Regime here in Nigeria,the Government Officials set up companies and awarded themselves contracts which were grossly over-invoiced in their various ministries. The present Government set up a Contract Review Panel and we have identified alot of inflat! ed! contract sums which are presently floatingin the Central Bank of Nigeria ready for payment. However, by virtue of our position as civil servants and members of the panel,we cannot acquire this money in our names.I have therefore been delegated as a matter of trust by my colleagues of the panel to look for an overseas partner into whose account we could transfer the sum of US$21,320,000.00 (Twenty-one Million Three Hundred and Twenty Thousand U.S Dollars). Hence we are writing you this letter. We have agreed to share the money thus; 1. 20% for the Account owner (you) 2. 70% for us (The officials) 3. 10% to be used in settling taxation and all local and foreign expenses. It is from our 70% that we wish to commence the importation business. Please note that this transaction is 100% safe and we hope to commence the transfer latest seven (7)banking days from the date of receipt of the following information by E-mail,your name, your companys name and Address, Telephone and fax nu! mb! ers. The above information will enable us write letters of claim and job description respectively. This way we will use your companys name to apply for payment and re-award the contract in your companys name. We are looking forward to doing this business withyou and solicit your confidentiality in this transaction. Please acknowledge the receipt of this letter using the above E-mail address. I will bring you into the complete picture of this pending project when I shall have heard from you. Yours faithfull Tinimbu Frank.

1 0

HUGE BREAKING NEWS! (NASDAQ:COOX) - WATCH THIS STOCK TRADE TOMORROW
by Investor Insights 27 Jun '02

27 Jun '02

1 0

IMPLEMENT ISO 9000 OR QS-9000 IN 90 DAYS
by quality＠onlinepji.net 27 Jun '02

27 Jun '02

1 0

What would you say to the perfect Match?
by matchnews＠match.com 27 Jun '02

27 Jun '02

All over allure Summer dating is about to get competitive! What are you doing to stay scintillating to singles? Have your updated your free profile? Have you tried a quick search? Are you checking those matches from Venus? Hop to it today, and get your social calendar packed! URL: http://www.match.com/profile/profile.asp?bannerid=512555 URL: http://www.match.com/qsearch/qsearch.asp?bannerid=512572 URL: http://www.match.com/venus/venus.asp?bannerid=512559 Tips: http://www.match.com/matchscene/mostofmatch.asp?bannerid=512539 Tour: http://www.match.com/tour/tour.asp?bannerid=501581 FAQ: http://www.match.com/help/faq.asp?bannerid=501531 Home: http://www.match.com/home/myhome.asp?BannerID=512552 QuickSearch: http://www.match.com/qsearch/qsearch.asp?bannerid=501670 Member Spotlight Go_N_Places It would be cool to meet a like-minded lady http://www.match.com/spotlight/showprofile.asp?UserID=494A4B4A4A4D4F&Banner… LittleMsMuffet Frightened of spiders and other icky stuff http://www.match.com/spotlight/showprofile.asp?UserID=46424644484F48&Banner… NEWS More singles use Match.com Messenger! Since the recent launch of Match.com Messenger - a fun and easy way to communicate instantly with other Match.com members - more and more singles are meeting their match! Take a tour and discover instant romance! URL: http://im.match.com/tour/welcome.asp FEATURES 15 ways to start your first email It's the moment of truth. You've spotted the perfect member, and you're ready to make contact. You open up the email, address the message, choose a flirty subject line and more URL http://www.match.com/Matchscene/article.asp?bannerid=512515&ArticleID=38 True Stories I decided to subscribe and actively search for love online at Match.com, so into the cyber- dating circle I went. I chatted a bit with a few men, met three in person, and then more URL:https://www.match.com/subscribe/subscribe.asp?bannerid=501624 URL: http://www.match.com/matchscene/truestories.asp?BannerID=512548&ArticleID=2… Cycle Ireland with Match.com and REI Adventures Join REI and Match.com on a unique biking adventure through the finest scenery in Ireland, August 29th through September 7th. You and fifteen other Match singles will more URL: http://www.reiadventures.com/match/emerald.html Add sizzle and spice to your summer plans Come celebrate single life this summer at Club Med Cancun's Mix and Match Bash presented by Match.com, July 25th through 28th. From intense more URL: http://www.clubmed.com/cgi-bin/clubmed55/Divers/News/NEWS_details.jsp?PAYS=… 115_MATCH&idpartenaire=match&idclientpart=match Guard your anonymity All correspondence between Match.com members takes place through our double-blind email system. Never include your last name, real email address, home address, phone number, placemore URL: http://www.match.com/Matchscene/article.asp?bannerid=512515&ArticleID=10 Visit Match.com , the world's largest online dating community. You've received this bulletin as a subscriber to the Match.com newsletter. To UNSUBSCRIBE, log in to Match.com, select My Account, and choose Match.com Newsletter under MY EMAIL OPTIONS. Copyright 1993-2001 Match.com, Inc. Match.com and the radiant heart are registered trademarks of Match.com, Inc.

1 0

TCPA / Palladium FAQ (was: Re: Ross's TCPA paper)
by Ross Anderson 27 Jun '02

27 Jun '02

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html Ross

2 1

War on terra
by Matthew X 27 Jun '02

27 Jun '02

Escaped mental patient matt taylor aka professor rat has been charged with threats to kill (2) and using a device to menace(2)Charges worth up to 10 years. Taylor has made no admissions and is scornful of evidence presented so far.(copies of webpages(1) and timestamped e-mail copy made 2 hours after (!)a BBS post/death threat.The computer dick claims to have 21 other 'e-mails'linking defendant to alleged threats.If they are as weak as the 2 presented in discovery then the entire case looks like a malicious persecution and/or abuse of process similar to harrassment of adult movie industry.Professor rat is confident of beating micky mouse charges and will carry on fighting for truth justice and the anarchistic way.

1 0