December 2003 - cypherpunks-legacy

SAIC Snags INFOSEC
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.disa.mil/ciss/itsc/docs/brochure.html INFOSEC Technical Services Contract The Solution to Your Security Needs Now! What is INFOSEC Information Systems Security (INFOSEC) is defined as the protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats. For operations and for economic efficiencies INFOSEC is an enabling feature. It is the discipline that protects the integrity, availability, and confidentiality of our information assets and systems. All information is important and valuable to its users and requires some level of protection from unauthorized disclosure (confidentiality), assured access by users (availability), and protection from unauthorized change (integrity). We believe that good security is a mission enhancer, not a mission detractor! Our overall approach to information systems is security is to PROTECT information using a layered defense based on risk management and cost benefit analysis. We must be able to monitor all our systems and networks in real time to DETECT intrusions or hostile actions at all levels, and then REACT to isolate the systems, correct the security breach, restore service to the users, and act to prevent future attempts. Center for Information Systems Security Background In July 1990, the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence ASD(C3I), started an investigation effort for coordinated DOD-level management of defense INFOSEC initiatives. DCA, now DISA, was designated as the lead agency with assistance from the National Security Agency (NSA). A DISA/Center for Information Systems Security (CISS) and NSA plan was developed and approved for establishment of the Defense Information Systems Security Program (DISSP). CISS has its origin in the Defense Information Systems Security Program (DISSP), a joint DISA/NSA program. Continuing as a joint program office CISSs mission is to manage, coordinate and provide direct INFOSEC application support to DOD programs, develop standards and protocols for INFOSEC and expedite the implementation of MLS command, control and communications systems for DOD. The CISS provides a means to fully review, coordinate, and make recommendations concerning the implementation of policy, architecture, and products to support DOD objectives. Mission The Center for Information Systems Security (CISS) is a joint DISA/NSA organization charged with executing the centrally managed Defensive Information Warfare (IW-D) and INFOSEC functions within DOD. CISS is the focal point for assuring availability, integrity, and confidentiality of all DII systems and information. We provide direct support to DOD services and agencies, and define requirements for DII INFOSEC standards. Additionally, CISS provides central coordination and reporting response to all DOD INFOSEC incidents, and operational protection, detection, reaction, and vulnerability analysis to the DII. What is the INFOSEC Technical Services Contract? DISA awarded the INFOSEC Technical Services Contract (INFOSEC TSC) on 12 July 1995 to two large businesses (CSC and SAIC) and one small business (MERDAN Group, Inc.). CISS, a joint DISA/National Security Agency (NSA) program, has been chartered to provide INFOSEC services throughout DoD. INFOSEC support will be provided by CISS infrastructure resources with contractual assistance from the INFOSEC TSC. The primary responsibility of the joint program office is to assure the effective and coherent application of INFOSEC to the overall Defense Information Infrastructure (DII). The contract offers technical support in the areas of: * INFOSEC Security Policy * INFOSEC Requirements Support * INFOSEC Architecture and Engineering * INFOSEC Independent Validation and Applications Verifications * INFOSEC Products and Applications DoD Goal Security Architecture (DGSA) * INFOSEC Certification and Accreditation Master Transition Plan * INFOSEC Technology and Training Documentation, and Countermeasures Information Dissemination * INFOSEC Multilevel Security Technology * INFOSEC Technical Managemet and Capabilities Planning (TMP) * INFOSEC ProfessionalizationProgram and Project Management * INFOSEC Standards and Protocols The contract is not a Federal Information Processing (FIP) hardware or software procurement contract. All DOD departments and agencies requiring INFOSEC services can utilize the INFOSEC TSC. The contracts are Indefinite Delivery, Indefinite Quantity (IDIQ) with individual firm fixed price, cost plus fixed fee, and time and material Delivery Orders (DOs) awarded for each requirement. Ceiling on the INFOSEC TSC is $1.095B which includes authority for other Federal (non-DOD) Agency use of 10% of current contract value. An additional 10% authority for non-DOD federal agencies is anticipated from GSA. There will be a 2 percent fee applied to all Delivery Orders. Details for submitting requirements are spelled out in the Guide for the INFOSEC TSC. Advantages of Using the INFOSEC Technical Services Contract * Provides contractual assistance in support of INFOSEC and INFOWAR requirements * Provides a means to obtain assistance in addressing complex systems security issues * Provides a high level of expertise to support systems certification and accreditation * Provides necessary DII/NII security support for DII/NII open systems architecture * Provides hardware and software support for INFOSEC prototyping and incidental hardware/software required to perform the task _________________________________________________________________ The INFOSEC TSC guide can be obtained from the: INFOSEC Technical Support Office (ITSO) Center for Information Systems Security 5111 Leesburg Pike, Suite 100 Falls Church, VA 22041-3201 Attention: Ms. Nanette Chopin (703) 681-1331 ---or--- Attention: Mr. James Lindou (703) 681-1333 FAX (703)681-1393 ---or--- through the World Wide Web at http://www.disa.mil/ciss/itso.html. _________________________________________________________________ SAIC Team Members * Bell Atlantic * Bellcore * CTA, Inc. * George Mason University * Information Security Systems, Inc. * JANUS Associates * Lockheed Martin * MICON Services Company * Pailen-Johnson Associates, Inc. * Secure Solutions, Inc. * Sprint * Technautics, Inc. * TeleCommunication Systems (TCS) * TELOS CSC Team Members * A.B. Floyd * Automation Research Systems (ARS), Ltd. * Bowie State * Computer Associates * DEC * DMR Group * Group Technologies * Intermetrics * IRE * Metters Industry * MIS Training Institute * Northrop Grumman * ORA * Oracle * RSSI * Space Applications Corporation * Systems Engineering Solutions, Inc. * Sparta * Spyrus * SRA * TASC * USATREX * Xerox Merdan Group, Inc. Team Members * Advanced Data Concepts, Inc. * Management Technology Strategic Association, Ltd. _________________________________________________________________ For More Information Contact the INFOSEC Technical Support Office Ms. Nanette Chopin, COR/DPM Voice: (703) 681-1331 Fax: (703) 681-1393 E-Mail to Ms. Nanette Chopin Mr. Jim Lindou, ACOR/PM Voice: (703) 681-1333 Fax: (703) 681-1393 E-Mail to Mr. Jim Lindou Defense Information Systems Agency 5111 Leesburg Pike, Suite 100 Falls Church, Virginia 22041 _________________________________________________________________ Return to: CISS TSC Home Page DISA CISS Home Page DISA Home Page _________________________________________________________________ You can mail any questions about these documents to: Ms. Nanette Chopin You can mail any questions about the DISA server to: yorkw(a)ncr.disa.mil - Last revision: 16 August 1995 okonw(a)ncr.disa.mil _________________________________________________________________

1 0

Re: Certificate proposal & X509 clarifications
by Rich Salz 17 Dec '03

17 Dec '03

> Therefore, you >have to get someone owning an OBJID tree branch to define meanings for you >- -- and you have to publish some worldwide book of mappings, etc. While I am no big fan of OID's (and I really dislike ASN.1 -- and nobody ever explained to my why the ISO RPC standard doesn't use it), if anybody really needs an ISO OID tree, I will probably be willing to tear off a piece of OSF's: 1.3.22 { iso(1) identified-org(3) osf(22) }

1 0

Re: Time Lag
by Rich Salz 17 Dec '03

17 Dec '03

Internet email is highly dynamic. Hosts can be up/down. Routers can be up/down. Gateways can be up/down. Routing databases can be out of date. Cables can be cut. Load averages can affect whether a host accepts SMTP connections. And so on. Sending one message and rigorously studying timestamps in the Received lines and using that to draw conclusions about mail propagation is a complete waste of time. /r$

1 0

RNG's and time-stamps
by Jim Choate 17 Dec '03

17 Dec '03

Now that is an idea, exploit the dynamic nature of Internet. Us the difference in times between the stamp and when the mail arrives to generate a RNG. Just a thought.

1 0

Re: Time Lag
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> Sending one message and rigorously studying timestamps in the Received > lines and using that to draw conclusions about mail propagation is a > complete waste of time. Ah, but when there seems to be an ongoing pattern of delays, and many people check many messages and find that indeed there is a pattern, it's not a waste of time, no? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

One-Time-Pad generation from audio device
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Over the weekend I hacked up a one-time-pad generator from the random number code I've been writing for Privtool, which uses noise from the audio device to generate random numbers. The code basically reads in a 512-byte block from /dev/audio, then takes the MD5 of that block to generate 16 bytes of the OTP. The raw audio data I'm getting is not particularly random and will compress by 3:1 using gzip or compress, so I'm assuming that using a 32:1 ratio here via MD5 will give a truly random output (it's certainly uncompressible). Before I release the source code to the Net, can anyone give me any good reasons to believe that this won't produce physically random output, or make suggestions on how to test, or improve, the generated output ? There's a #define which can be used to easily increase the amount of data fed into the MD5, but at the moment it will only generate about 1 MB per hour on a Sparcstation (limited by the audio input rate), so I don't want to increase that if I don't have to. Mark

3 3

Re: WHERE did this come from?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 18:38 9/30/95, rivaud(a)rain.org wrote: >Attatched to this is, (I hope), the header text from a unsolicited e-mail >message I received. The return address does not work. WHY? How can I >inform the sender that I hope to never receive there material again? > >I tried "reply-all" through Eudora, but my reply got bounced back to me >as undeliverable. > >I have removed the content of the original message. I don't know why it >was sent to me, but it contained material that I found offensive. > >Any help, or words of wisdom and enlightenment would be appreciated. >Information would be nice too. > >Thanks. This is a KNOWN SPAM (it is currently being talked about in the Net-SPAM Usenet Newsgroup). It has been coming from 3 sites (one in Italy, one in France, and one in Germany). The national Police in all 3 countries (as well as the FBI) are apparently investigating it. To track the situation monitor this Web Page (Which should be Globally Accessible): http://www.panix.com/~lan/crusader

3 2

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by blancw＠accessone.com 17 Dec '03

17 Dec '03

> Community Connexion, an Internet service provider that last week > promised a free T-shirt to anyone who found a flaw in Netscape > Communications Corp.'s software, extended the challenge Friday to > include holes in Microsoft products. ....................................... So what message will the T-shirts have on the front, Sameer? .. Blanc

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

In article <modemacDFr0qB.IyK(a)netcom.com>, Rt. Rev. Modemac writes: >Dr. Dimitri Vulis (dlv(a)bwalk.dm.com) wrote: >: The National Alliance are not the first despicable racist net.abusers who forge >: cancels for other people's articles critical of them on n.a.n-a.m. Ken Arromdee >: has condemned one such forger, the graduate student Pyotr Vorobiev from Lehigh >: University's Mechanical Engineering and Mechanics Department (+1 610 758 4100) > >When Scientology began cancelling posts by their critics on >alt.religion.scientology, Homer Wilson Smith wrote a program called >"Lazarus" to track for cancels. The idea is simple: whenever a cancel >message appears, Lazarus announces it on the newsgroup. > >Mayhap a Lazaraus-type program can be put into effect on >news.admin.net-abuse.misc? Many other newsgroups are affected by such net.abuse (Vorobiev-style forged cancels based on contents); I just saw some messages on forged cancels in soc.culture.jewish and soc.culture.german. I think running Lazarus-like programs in _all_ newsgroups would be an extremely Good Idea. Alas, the time when people used to contribute their time and equipment for the public good of the net seems to be over. Peraps I'm just dreaming; or perhaps Dave Hayes will like the following idea enough to implement it. Also, I think it's a matter of time before some Cancelpoodle figures to put 'light' into the Path: of its Vorobiev-style forged cancels; then they will not be seen by lighlink.com where Lazarus now runs. This needs to be addressed. Anyway, here are my thoughts on this proposal: There would be a collection (at least 5 or 6) of cancel-watchers (sort of like the deamons that now watch misc.test) all over the world. They should be well-connected (preferrably, one hop away from sites like uunet, howland.reston.ans.net, etc). Each watcher would look at incoming articles in "control", and whenever it sees a cancel, it would replace its own uucp name in the path by something like ellipsis (to keep it confidential) and forward the cancel to a central cataloguer (singly or in batches). E.g., is a watcher at xyzz123.uucp saw a cancel with the header Path: xyz123!howland.reston.ans.net!someplace it would send it to the cataloguer with the Path: replaced by Path: ...!howland.reston.ans.net!someplace The cataloguer would wake up every few hours (for example), group the collected cancels by message-ids of the cancelled articles, and e-mail reports to the (distinct) addresses (other than "usenet@*" or "news@*") mentioned in the "From:", "Sender:", "Authorized:", and "X-Cancelled-By:" headers, and quoting the entire cancel and the Path's as seen at different sites by the cancel-watchers. This way, if the cancel is forged, its author will learn within hours that it has been fraudulently cancelled and will automatically receive enough Path: samples from all over the world to see where it was posted, by comparing the Path headers in several copies of cancels. A user or an entire site should be able to "opt out" of having its cancels reported by sending a command to the cataloguer. There should be a limit of, say, no more than 100 such notifications sent to a site in one batch (to prevent too much traffic in the event of really massive forged cancellation). I don't have the resources to do this right now, but I would be happy if some civic-minder netters took this proposal and ran with it. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Introducing Johnson-Grace
by Publisher Program 17 Dec '03

17 Dec '03

Dear Web Publisher: You may have never heard of Johnson-Grace Company, but you have probably seen the benefits of our image compression technology in America Online and Apple's eWorld. "ART" compression substantially speeds up image transfers. In fact, ART formatted images transmit three times faster over conventional telephone lines than old-style GIFs and JPEGs. The immediate benefit is dramatically more compelling online content. Many of the hottest areas on AOL and eWorld are taking advantage of ART technology, including ABC, Business Week, The Smithsonian, NY Times, and 800-Flowers. Now, Johnson-Grace is able to offer the same benefit to Web publishers. To help you immediately reap the rewards of ART image compression on your Web site, Johnson-Grace is offering publishers the latest copy of our ART Press(TM) on a FREE trial basis for the remainder of calendar 1995. ART Press lets you easily convert your images to the ART format with its unique Web and online publishing features. For example, our proprietary Splash(TM) feature displays a full-size image in roughly one second; the image then becomes sharper as more detail is received and decompressed in additional layers, producing a high-quality final image within seconds. To get your free trial copy of ART Press, simply sign up for the "Johnson-Grace Publishers Program," a new program designed specially for Web and online publishers. At the foot of this email is an enrollment form. Just fill it out and email or fax it back to us. We'll send you the software right away (usually within 24 hours). For even faster results, just sign up online through the Johnson-Grace Web site (http://www.jgc.com/) Besides receiving ART Press, another prime benefit of joining our Publishers Program is that you will be automatically notified when any new versions of the software become available. Here are two more benefits: * FREE Technical Support -- For the remainder of calendar 1995 you will receive free expert technical advice on using ART Press. Support is available by email or by phone. * FREE Image Compression -- To help you get started with ART Press, Johnson-Grace will compress your original images into the ART format free of charge. Simply provide them to us in BMP, TIFF, or PICT format, and we'll do the rest. We've devised a method for allowing both ART and non-ART images to be accessed from your Web site depending on whether or not an ART-enabled browser is being used. Johnson-Grace and some of the larger browser companies have introduced a new extension to HTML, the X-ALTSRC attribute in the <IMG> tag. (<IMG> is the standard tag used to insert images into a Web page.) It indicates to ART-enabled Web browsers that an ART image is present. When an X-ALTSRC attribute is found, ART-enabled browsers will automatically use the ART image named in it, bypassing a SRC attribute it may find naming a GIF (or JPEG) image. Browsers that do not recognize the X-ALTSRC attribute will ignore it and read the SRC attribute instead, so there's no risk of incompatibility with these "old-style" browsers. Currently, AOL's built-in TurboWeb browser as well as other Web browsers including GNN and TeacherSoft recognize this new HTML attribute, representing a community of well over three and a half million users. As announced by Netscape, Johnson-Grace will be one of the first companies to provide a free plug-in for Netscape 2.0 which will allow Netscape users to take advantage of the ART format. This plug-in will be delivered as a "virtual bundle" so that support for the ART format will be automatically added to the browser the first time an ART image is encountered. Additionally, Johnson-Grace is in discussions with all the other major Web browser companies to include ART technology in their products. We expect broad support by the end of the year. Check out the Johnson-Grace Web site (http://www.jgc.com) to learn more about how to use ART's triple-speed advantage on your Web site. You'll also find a host of other useful information there designed specifically for publishers. In the months ahead, look for Johnson-Grace to provide additional "Instant Publishing" capabilities for Web and online service publishers. For example, later this year you'll see news of ART speech compression technology that will enable publishers to author interleaved sound and images for real-time playback at 14,400 bits per second. Think about what real-time sound can do for your Web pages! If you have any questions about the program, feel free to email techsupport(a)jgc.com. You can also call Tech Support at (714) 759-0700, or fax us at (714) 729-4643. Best regards, Geoff LeBlond VP, Licensing Johnson-Grace Company Enrollment for Johnson-Grace Publishers Program Please provide the following information to enroll in the Johnson-Grace Publishers Program Name: Title: Company Name: Company Address1: Company Address2: Company Address3: Company Address4: Telephone Number: Fax Number: email Address (email address is required to process your request) : Version of Software needed [ ] Windows [ ] Macintosh [ ] Both Type of Publisher (select one) [ ] Newspaper, Magazine, or Newsletter [ ] Merchant [ ] Company (e.g., product and sales information) [ ] Government or Non-Profit Organization [ ] Other (please specify) : Target Audience (check all that apply) [ ] Web [ ] Online Service(s) [ ] Both Web Site Information (1) Home Page Location (URL): (2) Launch Date: (3) Webmaster e-mail address: Note: By sending this registration form to Johnson-Grace Company, you agree to follow the following Publishers Program restrictions. (1) Do not use a trial version of ART Press after the end of the trial evaluation period. (2) Only Web and online service publishers -- defined as companies, organizations, or entities that offer content or information for display on the Web or on an online service for commercial purposes -- may qualify to participate in the Johnson-Grace Publishers Program. (3) Do not distribute copies of the program (all users must enroll), or attempt to reverse engineer the program. (4) Report any problems with the program to the Publisher Support Hotline at internet address techsupport(a)jgc.com, fax 714-729-4643, or telephone 714-759-0700 (ext. 215 or ext. 230).

2 1