December 2003 - cypherpunks-legacy

AP on trashing/computer fraud ring
by cman＠communities.com 17 Dec '03

17 Dec '03

Although I generally agree that capturing information online has certain advantages to the criminal over going through the trash, that certainly didn't stop this bunch. Doug [wondering if this will affect the market for home shredders] ======================= ATLANTA (AP) -- Thirty people have been charged in a $10 million fraud scheme that involved counterfeiting checks, bank statements and credit card receipts pulled out of the trash. ``What we're finding is people are getting more and more clever with what they pull out of the trash,'' U.S. Attorney Kent Alexander said. ``This is the most clever scam I've ever seen.'' The defendants, who defrauded people in 17 states, used checks, bank statements, credit card receipts and other documents from garbage bins to create counterfeit checks, false driver's licenses and false credit reports, Alexander said. Investigators said software was used to rub out information on the discarded paper. Counterfeit blank checks, printed on high-quality color printers, were allegedly used to defraud banks of $2 million. A core group of about eight people moved the operation to Atlanta from New Jersey five years ago because they thought it would be easy to take advantage of Southerners, the prosecutor said. Of the 30 people charged, 24 have pleaded guilty, Alexander said. Twelve of the 24 have been sentenced to jail terms of up to eight years and restitution of up to $218,070.

1 0

airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Roy M. Silvernail wriote: >Have you flown recently? They now ask you this scripted question about >whether you have been approached by anyone you don't know since arriving >at the airport, and warn you not to accept anything from a stranger or >leave your carry-on baggage unattended until you board the plane. The >ticket agent told me it was a "new FAA regulation". I hadn't flown >anywhere for a few years. Anyone know how long this has been happening? > Goodbye freedom, hello police state. >I wonder how long before I need a passport to cross a state line... The US is merely trying to catch up to what the Europeans have been doing for over a decade. In fact, the US still has a way to go. You ought to pass through Heathrow in London some time to see what real airport security looks like. The US security changes are a recent response, starting after the World Trade Center bombing and being stepped up on a continuing basis. Today you need a picture ID to board with your ticket. Tomorrow...? We have lived in relative safety compared to the rest of the world, but I think those days are over. Usual disclaimer. Bob Bruen.

5 4

Netscape rewards are an insult
by fc＠all.net 17 Dec '03

17 Dec '03

The idea that Netscape (like Microsoft) thinks they can get free testing services from all over the net by real experts just by offerring a tee shirt is down right offensive. I have a better idea. How about an open market in break-in software. We crack Netscape and offer the crack code to the highest bidder. Bids start at US$25K per hole. For the insult, Netscape has to outbid the competition by a factor of 2 to get the details of the hole. Here's how it works: - We get a panel of 5 cypherpunk judges who test each claimed hole. - Exploit code is sent to the panel for verification. - If they verify the hole, it is put up for bid. - Winning bidder gets the code for 3 months before it is released on hacker BBS systems throughout the world. - The panel of judges splits 25% of the money paid for the code as pay for their efforts. The rest goes to the author. I have an even better idea. How about if Netscape gets some competent programmers with real security expertise, adds in some good change controls, a serious internal testing program, quality control ala ISO-9000, internal IT auditors, external IT auditors, training and education for their employees, and everything else it takes to be in the software business in a serious way. As an alternative, we could help them contact the shareholders for a lawsuit. After all, they are a public company now and are responsible to the shareholders for the value of their stock. If it goes down because they aren't doing an adequate job of software quality control, the officers may be personally liable. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

7 8

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: > The idea that Netscape (like Microsoft) thinks they can get > free >testing services from all over the net by real experts just > by offerring >a tee shirt is down right offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors, which are piling now, on MS being a Peeping Tom when it comes to hard drives are true, I wonder if there might be a way to send a byte bomb to their bit bucket??.......

1 0

Re: Netscape question transformed
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:12 PM 10/13/95 -0700, jsw wrote: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so >> hackers have time to find bugs before the full version is released. Don't >> take me wrong I have only been on the net fer a little over a year and Love >> Netscape. And If I knew what I was Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the >company, it is virtually impossible to get complete testing coverage. >Given the incredible variety of machines, OS's, peripherals, etc. >that are available in the real world, there is no way we could >re-create every possible configuration in the lab. I think that the main reason people have problems with the testing offer on the beta is the lack of responses to bugs in the past. I have seen many complaints from people on the net complaining that bugs they had reported in .90 had continued on into new and continued versions. That if they recieved a message back from Netscape it was just an infobot, and a rather hostilly worded one at that. (The infobot has been lightened up a great deal.) Netscape has never had the staff to properly respond to the mail volume they have recieved. They have been trying to improve this but it is difficult to man such a project with people who are able to sort through the piles of dreck to find those people reporting serious problems. (Also, the bug rewards are only for "serious bugs". Who defines what is serious and what is not. I know of a couple that have been hanging around for a couple of versions now. Maybe I should test if they got fixed with 2.0b1. Probibly not. They only hit a handful of people.) Netscape is still a pretty new company. Some seem to forget that .90 was only released about a year ago. How long does it take to get a proper QC department in place? (After the shakeup in February(?) when the new President was hired, I would have thought it would have been done then. Now I am not so sure...) I know of at least one product that went out the door in recient months that was not properly tested. (The stack and dialer used with Netscape PE comes to mind.) I realize that sales sometimes forces things to be released before its time, but there has to be some basic controls for quality control. (I will not mention some of the bigger gaffes with 1.0 and 1.1 since not all of those were publicized. A few simple things could have caught them before they went out the door.) I want to see Netscape succeed, but when you hear about things like product being released on the net without warning those people responsible for supporting it, bug reports being ignored so a ship date can be made, and the like, it makes you really wonder. I am finding problems with 2.0b1 that could have been found just by using the product for a couple of days! Most of the problems I have seen with Netscape could be solved with better communications between departments within the company and some strong testing procedures. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. Somethings are real simple. Things like giving it to a handful of people and letting them use it for a couple of days before you release it to the rest of the world. 90% of the bugs will be pointed out through having someone beat on it as they would any other peice of software. And those people should be someone other than the programmers. (Sometimes you get too close to the code to really stress it properly.) I agree that you need to have a beta program. Not everything can be tested. But QC is important. This is not Uncle Jim's pet project anymore... All of this has been brought up on the net before. Sometimes it seems like the responses are more defensive than trying to find out the real problems and fix them. So far, you have been one of the few who has pushed for getting some of these things fixed in a timely manner. (I can name a few others as well. They seem to get burned out after a while though...) I think my biggest questions right now are: "Is there a formal testing procedure for product that is about to go out the door? Is there a real QC department and do they have the power to stop releases if significant problems are found?" | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

[URGENT] Where are we meeting today?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, I spaced the announcement and I can't find it in the archive. Somewhere at Sun... Would someone please forward me the original post? TIA, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH/+ACoZzwIn1bdtAQGkrgF+JqKcgWrM4VFYaQGbmR6gCg5SBzQe5Php Qv9OxqnfcFFgbs6ZzzMkf+IietdzliuI =SZst -----END PGP SIGNATURE-----

1 0

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: >The idea that Netscape (like Microsoft) thinks they can >get free testing services from all over the net by real >experts just by offerring a tee shirt is down right >offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors of MS being a Hard Drive Peeping Tom are true, then I wonder if there might be a way to send a byte bomb to their bit bucket??....... Be Well

1 0

Re: [URGENT] Where are we meeting today?
by cman＠communities.com 17 Dec '03

17 Dec '03

Place: Sparcy's cafeteria, building 21, Sun Microsystems Mountain View, California Directions: Take 101 to Amphitheater Parkway. Turn left onto Garcia, and drive about 1/2 mile and turn onto the first genuine side street which is named Marina Way. Drive about 1/4 mile and look for a right hand turn onto Coast. Building 21 will be on your left. It's on the corner of Coast and Marina Way. There's plenty of parking there.

1 0

DSS patent license
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>>> RSA Data Security, Inc. >>> today announced that it is now licensing patents for the Digital Signature >>> Standard (DSS), the U.S. government standard for digital signatures. >> >> I believe someone was suing the U.S. government on the grounds that the >> public signature standard wasn't supposed to require proprietary >> technology. Has this gone anywhere yet? >> >> -- >> Eli Brandt >> eli+(a)cs.cmu.edu Yes, I had such a lawsuit. No, it didn't go anywhere in the courts, but the feds did eventually cave in to the principal demand of my suit: That the DSA patent be made available to anyone on a royalty-free basis. So how is it that RSADSI and Cylink/CKC claim you need licenses to their patents to use DSS? Because they have other patents. I have another lawsuit directed at those patents. Stay tuned. Roger Schlafly rschlafly(a)attmail.com

1 0

Top Math & Physics Sites (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0