December 2003 - cypherpunks-legacy

nyt: Report Warns of Security Threats Posed by Computer Hackers
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Copyright 1996 The New York Times Company May 23, 1996 Report Warns of Security Threats Posed by Computer Hackers By PHILIP SHENON [W] ASHINGTON -- Government investigators warned Wednesday that computer hackers cruising the Internet posed a serious and growing threat to national security, with the Pentagon suffering as many as 250,000 "attacks" on its computers last year. The investigators, from the General Accounting Office, offered scenarios in which terrorists or enemy governments might break into Defense Department computer networks and shut them down, cutting off communications between military commanders in the middle of a war. "There will become an increasingly attractive way for terrorists or adversaries to wage attacks," the investigators said in a report prepared for two congressional committees. "The potential for catastrophic damage is great." The Pentagon did not dispute the findings of the study, although Defense Department officials said they knew of no instance in which hackers had obtained secret information or gained access to computer networks that control the firing of weapons. "We are certainly well aware that people are breaking in or trying to hack into our systems," said Susan Hansen, a department spokeswoman. While the Pentagon is developing encryption devices that show promise in defeating computer hackers, the accounting office, which is the investigative arm of Congress, warned that none of the proposed technical solutions was foolproof, and that the military's current security program was "dated, inconsistent and incomplete." The explosion in the use of the Internet and the increasing power and sophistication of small desktop computers has compounded the Pentagon's problems, creating a worldwide army of hackers able to break into all but the most secure computer networks. The report cited Defense Department estimates that the number of unauthorized efforts to enter its computer systems -- "attacks," in the parlance of cyberspace -- was doubling every year and may have reached 250,000 in 1995, most of them made through the Internet. Pentagon figures suggest that in about 65 percent of those efforts, hackers were able to gain entry to a computer network. The investigators provided details on several recent attacks on the Pentagon's computers, including a 1994 incident in which two computer hackers were able to gain "complete access to all of the information" on the computer systems of the Rome Air Development Center, the Air Force laboratory in Rome, N.Y., where the Defense Department carries out some of its most important research on weapons systems. The report said the hackers rummaged through the computer networks for several days and stole information on the methods used by Air Force commanders to relay secret intelligence and targeting information during wartime. Working through the Internet and a variety of phone switches in South America, the hackers also used the laboratory's computers as a "launching platform to attack other military, government, commercial and academic systems worldwide," including the Wright-Patterson Air Force Base in Ohio and the Goddard Space Flight Center in Greenbelt, Md., the report said. One of the hackers, a Briton whose code name was "Datastream Cowboy," was later arrested in England. The authorities say they do not know the nationality of the other hacker, whose code name is "Kuji" and who was never apprehended. "There may have been some national security risks associated with the Rome incident," the report said. "Air Force officials told us that at least one of the hackers may have been working for a foreign country interested in obtaining military research data or information on areas in which the Air Force was conducting advanced research." The foreign country was not identified in the report. In separate incidents between April 1990 and May 1991, the report said, hackers from the Netherlands broke into computer networks at 34 Defense Department sites and browsed the electronic-mail systems of several department officials, calling up all messages that contained the key words "nuclear," "weapons" or "missile." The accounting office investigator who oversaw the report, Jack L. Brock Jr., said in testimony Wednesday before the Senate Permanent Subcommittee on Investigations that more than 120 nations are reported to be developing "information warfare techniques" that could "allow our enemies to seize control of public networks which Defense relies upon for communications." "Countries today do not have to be military superpowers with large standing armies, fleets of battleships or squadrons of fighters to gain a competitive edge," he said. "Instead, all they really need to steal sensitive data or shut down military computers is a $2,000 computer and modem and a connection to the Internet." The investigators said the Pentagon had made itself vulnerable to attack by making itself so dependent on computers and the Internet, a system that its own researchers created in the 1970s. "Defense's computer systems are particularly susceptible to attack through connections on the Internet, which Defense uses to enhance communication and information sharing," the report said, noting that an estimated 40 million people worldwide are Internet users. "In turning to the Internet, Defense has increased its own exposure to attacks." The Pentagon uses the Internet to distribute electronic mail and other information. During the war in the Persian Gulf, the Defense Department used the Internet to communicate with allied armies and gather and distribute intelligence information. _______________________ Regards, When we ask advice, we are usually looking for an accomplice. -Marquis de la Grange Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

Number one story on CNN this hour.
by Alan B. Clegg 17 Dec '03

17 Dec '03

There are 40 million 'attack capable' systems connected to the Internet and over 120 countries have developed or are developing 'attack software'. [BTW, there will be a BUNCH more attacking systems when 'a new protocol is deployed because they are running out of addresses'] Sheesh. -abc \ Alan B. Clegg Just because I can \ Network Technologist does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

4 3

The Political Map, (was Re: FTC online workshop on privacy)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:14 AM 5/23/96 -0400, Shabbir J. Safdar wrote: >There's actually an interesting parallel here. If you look at the >Dworkin "ban pornography because speech is action" crowd, they often >end up on the same side of things as the Christian Coalition "ban porn >because it drives you to ungodly acts" crowd. They both happily support >legislation that would ban such images. The left and the right move so >far off the edges of the scales that they come around and meet each other >on the same side of the issue. This is because any analysis of political opinion that tries to reduce it to a one dimensional metric is ipso facto wrong. Two dimensions gives you a much better match. (Try personal freedom on one axis and economic freedom on the other.) I suspect the more dimensions you include, the better you analysis will be. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: INFO: Transcript of Sen. Leahy's RealAudio chat now available! (5/22/96)
by jim bell 17 Dec '03

17 Dec '03

At 01:34 AM 5/23/96 -0400, Voters Telecommunications Watch wrote: > REALAUDIO TRANSCRIPTS OF LEAHY'S WIREDSIDE CHAT AVAILABLE > Date: May 22, 1996 > URL:http://www.crypto.com/ crypto-news(a)panix.com >NEWS >Rave reviews of Senator Leahy's appearance on HotWired's WiredSide chat >are coming already. With this appearance, the gentleman from Vermont >proves once again that he knows net.politics on a personal level, and >can understands the subtleties that we assume many in Congress are just >learning. Well, he must have learned it all in the last few months, because his bill was the closest thing to DOA that we've seen in a long time, exceeded only by GAK 3. I'd like to hear from him what the source of the text of the Leahy bill on encryption really was: Who pressured him to make it so bad? Jim Bell jimbell(a)pacifier.com

1 0

Re: The Crisis with Remailers
by Bruce Baugh 17 Dec '03

17 Dec '03

At 11:30 PM 5/22/96 -0400, Joined Trill wrote: >On certain political newsgroups (perhaps most noticeably in the >soc.culture.* heirarchy) it's common to see someone's views refuted >because they are identified with a particular interest group. Now _there_ is a good point, well-known to the sort of people I'm concerned about presenting good advocacy to. Thanks! -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: CLI_pr3
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:17 PM 5/23/96, John Young wrote: > 5-23-96. WaJo: > > "Chasing Criminals at Cyberspeed." .... > Says Stanley Morris, director of FinCEN, "The only way > we can adequately assist our federal law enforcement > counterparts in following the trail of the multinational > money launderer is through our linkages with > multilateral arrangements such as ... [Clipper 3]." Of course, this appears to be implying that _domestic_ data will be subject to Clipper 3 restrictions, else this statement is meaningless. So, will my stored-value cards that I "charge up" in California and carry in my wallet to Zurich be GAKked? If not, Morris's statement is meaningless. If so, domestic data is intended to be GAKked. (But we knew this, didn't we?) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

National Journal article sez net-activism is just political hicks
by declan＠well.com 17 Dec '03

17 Dec '03

>Date: Thu, 23 May 1996 11:04:50 -0700 >From: jwarren(a)well.com (Jim Warren) >Subject: National Journal article sez net-activism is just political hicks >Sender: owner-fight-censorship(a)vorlon.mit.edu >Precedence: bulk >X-URL: http://fight-censorship.dementia.org/top/ > >Tommorrow, Washington's politically-powerful National Journal reportedly >will publish a know-nothing piece of "journalism" saying that net-aided >politics is essentially nothing but a batch of ineffective, know-nothing >nerds and back-water political hacks. > >Check it out on Friday or thereafter -- at www.politicsusa.com -- and >forward your *informed* comments to the NJ's Editor and Letters Editor. > >--jim > >On the other hand, maybe we ought to just continue escalating our political >effectiveness using the net, and let it come as a total shock to the >Beltway insiders who trust this piece of misinformed blather ... when we >provide more and more swing votes in contested elections -- as already >occured with DeFoley8 against ex-Speaker Tom Foley, VTW for now-Senator Ron >Wyden, me for now-available Calif legislative data, the gun BBS against >ex-Calif Senate Prez Pro Tem David Roberti, etc. :-) >

1 0

Re: draft NIST key escrow paper
by Carl Ellison 17 Dec '03

17 Dec '03

At 16:38 -0400 5/21/96, Pat Farrell wrote: >http://www.isse.gmu.edu/~pfarrell/nist/kmi.html after sentence 1 of their introduction, people might want to re-read http://www.clark.net/pub/cme/html/civ-own-crypto.html "Government can no longer monopolize state of the art cryptography." It's about time they admitted that governments historically had no monopoly on state-of-the-art cryptography. > >Enjoy >Pat > >Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell >Infor. Systems and Software Engineering, George Mason University, Fairfax, VA >PGP key available via finger or request #include standard.disclaimer - Carl +------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2| | "Officer, officer, arrest that man! He's whistling a dirty song." | +-------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: An alternative to remailer shutdowns
by jim bell 17 Dec '03

17 Dec '03

At 09:02 PM 5/22/96 -0700, Martin Minow wrote: >Black Unicorn <unicorn(a)schloss.li> comments on the responsiblity >of prudent persons (in, I presume, the context of threating e-mail >sent through an anonymous remailier). > >I'm still perplexed: what can a "prudent" remailer operator do if a >threatening e-mail was sent through a remailer under one or more of >the following conditions: > >-- The remailer operator is legally enjoined from reading messages > transversing his system. (For example, the remailer is subject to > data privacy laws.) > >-- The message was encrypted using the intended recipient's public key. > (This means that, without access to the private key, the operator > has no mechanism to examine the e-mail.) That's just it, the government wants (or, will want) "the prudent operator" to SHUT DOWN his system entirely. We, on the other hand, should take the position that operating a remailer is a right, and further that such remailers get a broad immunity for materials send through their system. Providing for the opposite was one of the reasons the Leahy bill on encryption was so bad. It criminalized use of encryption to "thwart a law-enforcement investigation" and there was no way for a (encrypted) remailer operator to know that any given message flowing through his system might eventually trigger such an investigation. In fact, the prospect of the government actually setting up such an operator by having his remailer act as the last link in the chain of an otherwise-untraceable message, whose transmission could arguably be a violation of law. Jim Bell jimbell(a)pacifier.com

1 0

Re: An alternative to remailer shutdowns
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:05 PM 5/21/96 -0500, you wrote: >To make it easy, how about a two part MIME message with the key and the >PGP-encrypted message. The message text would be directions on opening >it up, and breaking the "seal", which constitutes acceptance of the >remailer terms... Is that really any different than delivering the message rot-13? One of the reasons people object to getting anonymous email is spam; sending "You have mail; pick up message-id #2718281828 by midnight tonight!" encourages you to go to some effort to pick up the message, so you'll be even more annoyed if it's spam. Similarly, for hate-mail. PROPOSAL -------- On the other hand, a pickup system could reduce directed spam, if people generally don't pick up remailer pickups unless they recognize the messageid, leaving the remailer system to people who actually want to communicate with each other anonymously, which _had_ been one of the original goals of remailer systems. Protocol support requirements:? We could build in a fancy header, or we could just use the Subject: line, which many remailers know how to paste in anyway, and let the remailer do a messageid. Response mechanisms should probably be an email message to the remailer :: Deliver-Message: 2718281828 A secondary concern is handling multi-casts - should the remailer create one copy for each recipient (secure, easy, space-wasteful), or should it try to get fancy and keep the message for N recipients or D days? Two ways to implement the fancy version are to keep a flag that says not to delete the article upon receipt, while the normal behavior deletes it, or to use different keywords for picking up delete-after-pickup and shared messages. NEGATIVES --------- The big negatives with this approach are that it doesn't support PGP-encrypted messages, since they don't easily fit into one line, while they also encourage people to forget that the header of their message will be delivered insecurely. But it's probably close enough for non-anti-government work. Of course, it also doesn't do chaining; that either needs to be implemented by recognizing well-known remailers and forwarding directly instead of pickup, or by using a standard message format, so other remailers could do pickup. It's probably worth doing both, to support other remailer types transparently and to allow remailers to use pickups without having to be well-known. Adding automatic remailer registration is easy, but requires care to avoid spammers falsely registering victim(a)wherever.com as a remailer and then spamming. SPAM POSSIBILITIES ------------------ That still allows 1-line spams like Subject: <Expletive Deleted>! You <perjorative deleted><ethnic slur deleted>! or Subject: Our new Remail-Spam(tm) system lets you fit 1015 characters in a Subject: line, just like this one, so your whole message can fit through those anti-marketing filters! You can MAKE M0NEY REAL FAST building your downline - send e$1 of Bank Foo ecash to the top three addresses in the Cc: line but at least it cuts down on the annoyance level. It also supports messages like Subject: Secrets of the Scientologists for Sale! Pick up message for free sample and price list! Operate your own Thetan today! which permit direct-e-mail spams, or as some people prefer to call them, marketing opportunities. An interesting security/legality wrinkle is that if somebody is trying to multicast-publish unencrypted contraband data, it's sitting around in the mail-pickup spool, it can be seized by Bad Guys / courts / sheriffs / etc. As with most remailers, there's also a risk that outgoing unicast mail could be seized while in the spool, which is higher for a pickup system because the data may be in the spool longer. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

2 1