December 2003 - cypherpunks-legacy

Re: CIA Fears UmpTeen InfoNukes
by vin＠shore.net 17 Dec '03

17 Dec '03

Mike McNally <m5(a)vail.tivoli.com> queried the List: >By the way, there was a thing in the Yahoo/Reuters feed about "attacks" >on DoD computers; apparently British police arrested a "hacker" the >other day. Anyway, the article included a claim that there have been >250,000 attempted break-ins on DoD computers over the past year. > >Does anybody know how they count that? I don't know if they go so far as to count pings, but it seems they do try to count ISS/Satan/Pingware scans -- and then they project off what numbers they have to come up with the estimates. But no one is particularly careful about these numbers... certainly not the politicians nor the press. The estimates come from the Defense Information Systems Agency (DISA) and refer to "attacks" on the 2.1 million computers, 10,000 LANs, and 100 long-distance networks. (It is unclear whether DISA also includes the defense contractors' machine and networks -- another 2 million, as I recall -- but, by US law, those are also considered Defense systems.) According the May 22 GAO report: "DISA estimates indicate that Defense may have been attacked as many as 250,000 times last year. However, the exact number is not known because, according to DISA, only about 1 in 150 attacks is actually detected and reported. In addition, in testing its systems, DISA attacks and successfully penetrates Defense systems 65 percent of the time." (It is unclear whether this estimate process is circular, with DISA -- all and all, a generally capable crew, which normally doesn't bother with this sound-bite silliness -- "projecting" the total number of attacks by taking the number of reported attacks and then enhancing that number by multiplying it by the percentage of their own attacks on DoD systems which go unremarked.) Jack Brooks, the director of the GAO's Defense Information and Financial Management Systems, who presented the GAO's formal report ("Computer Attacks at Department of Defense Pose Increasing Risks") gave some further explication: "Not all hacker attacks result in actual intrusions into computer systems; some are attempts to obtain information on systems in preparation for future attacks, while others are made by the curious or those who wish to challenge the Department's computer defenses." Some numbers seems slightly less puffy: officials at Wright-Patterson Air Force Base reported that, on average, they receive 3,000 to 4,000 "attempts to access information each month from counties all around the world." There are real problems effectively securing DoD's unclassified computers -- both the military's own systems and the defense contractors -- but its sad how completely the real problems are being overlooked (or, at least, overshadowed) but the obsession with the InfoWar threat and teen cyberdemons being manipulation by Iraqi secret agents. Historically and at this moment, the vulnerability of the DoD computers -- as illustrated by hacker attacks and (almost certainly) by DISA itself -- lies in untrained and poorly managed system administrators who simply do not bother to apply even the CERT-labelled patches to their systems. There are brilliant hackers about (some in DISA; maybe even a few on this list) but they would but rarely need that brilliance to penetrate the typical DoD system. I'd bet cold cash that DISA's own tiger-team attacks on DoD systems are almost always successful with nothing more innovative than an ISS or SATAN scans and/or a list of CERT-announced security problems from the previous six months. The real threat is incompetent, poor-trained DoD system administrators -- and a class of computer-illiterate senior managers who define "system security" and routine administration as a marginal expenses and scorn readily available options like one-time passwords as too complex for the military mind. Much, much, easier to rail at the terrorist threat exemplified by the 16 year-old Brit who called himself "Datastream Cowboy" and to hint darkly that his unidentified cohort "Kuji" may have been a Russian or an Iraqi. The hell with security, let's wiretap the phones of all 16 year-olds! Cliff Stoll and Peter Neuman of SRI are supposed to testify, and they might bring some common sense to bear -- but I for one desperately wish to hear the like of acid-tongued Bob Courtney, IBM's former director of Info Security, chew this fluff up. The Datastream attack, btw, didn't occur "the other day," as Mike McNally suggested -- this whole media flurry is built around a retelling of Datastream's 1994 attack and arrest. It's just that the Air Force CERT did a nice job of documenting the good guys' effort to identify and track him down -- although Lord! the kid was dumb, no Morris Jr. there! -- and writing up a report. Makes you realize how desperate some folks are for cyberterror stories, doesn't it? Wonder why????? Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

New type2.list/pubring.mix combination
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, I have just updated the type2.list/pubring.mix combination on jpunix.com. Of note, I have dropped ecafe-mix as it has not responded in a LONG time and it doesn't look like it's going to get fixed any time soon. There are two new type II remailers on the list, Ad and lucifer. Welcome aboard! The lists are available by WWW from www.jpunix.com and by anonymous FTP fro ftp.jpunix.com. If you have any questions about the lists, please send email to perry(a)alpha.jpunix.com. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdJl3VOTpEThrthvAQGjEgP+N+DqShSfaWdqdxzlp9wCI+m1H3RXxKaz JPr2WLKXjmYImH72X3CvNuEQY19fV1N/n0iVoKFY0xwz814dMf6MMM4Wt5D1gxfk HjYvMFWuRVFMR5cN3DJIN/lAIV7zY4Pga77gVu3eo0Q3hN8SCP2ZIiMAStkA+6e/ v6FXGIeijUo= =AbdV -----END PGP SIGNATURE-----

1 0

MS-Mail Security
by Leo WONG Wing-yan 17 Dec '03

17 Dec '03

Hi all, I would like to gather informations of whether the MS-Mail server is secure or not, is anyone heard of somebody, say, disguise as other user or read other user e-mail? Thanks a lot Best regards Leo Wong

3 2

Ga Law/No False Identity
by nowhere＠alpha.c2.org 17 Dec '03

17 Dec '03

Mailing from Electronic Frontiers Georgia 6/27/96: ----------snip---------- :Subject: [EFG] GA law criminalizing Spam cancels?? ----------snip---------- :Electronic Frontiers Georgia has engaged the law firm of Bondurant, Mixson, :& Elmore (specifically Scott McClain) to look into a court challenge of :HB1630 "The Internet Police Law" which goes into effect on July 1st. We see :this as an unecessary and badly framed law. : :This law would appear to make it a Georgia criminal act to remove spam & :spews from newsgroups. This is law OCGA 16-9-93.1 : :Some information can be found at : : http://ninja.techwood.org/~efg/ : :under the "Day the sites went out in Georgia" section. : :My understanding, and the perception of spammers seems to be that in order :to cancel a message, you must forge headers to become that person, thereby :falsely identifying yourself. This seems to be in direct violation of the law : : It shall be unlawful for any person, ... to transmit any data : through a computer network ... if such data uses any individual : name, ... to falsely identify the person, ... : ----------snip---------- : -- Robert Costner : Electronic Frontiers Georgia : rcostner(a)intergate.net Spamming aside, this strikes at my privacy and choice of anonymity.

1 0

Re: CIA Fears UmpTeen InfoNukes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:57 AM 6/27/96 -0400, Vin McLellan wrote: >... The real threat is incompetent, poor-trained DoD >system administrators -- and a class of computer-illiterate senior managers >who define "system security" and routine administration as a marginal >expenses and scorn readily available options like one-time passwords as too >complex for the military mind. Public key authentication could go a long way toward solving the military and contractor's security problems. However, they won't use public key authentication for unclassified systems until it is available in "COTS" (Commercial, Off The Shelf) software. And it won't be available there until it can be exported as well as sold domestically. Catch-22 ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

2 1

my senate testimony
by Matt Blaze 17 Dec '03

17 Dec '03

I sent a copy of my senate testimony here last night, discovered that a bunch of lines were truncated, and (I thought) immedately sent out a revised, corrected version. The garbled version got forwarded to a bunch of mailing lists, however, and now I'm getting dozens of messages from people telling me about the truncated lines. The corrected version can be found at ftp://research.att.com/dist/mab/testimony.txt Please forward this version (or the URL) to anyone to whom you forwarded the the garbled version. Thanks. -matt

1 0

Re: MS-Mail Security
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-=> Quoting In:wywong2@cs.cuhk.hk to Harka <=- In> I would like to gather informations of whether the MS-Mail server In> is secure or not, is anyone heard of somebody, say, disguise as other In> user or read other user e-mail? I'd also like to know how secure the MS-Mail files are (*.mmf). They are password protected and should be encrypted but does anybody know how secure? Harka ___ Blue Wave/386 v2.30 [NR]

2 1

Re: Grubor remailer? (Was Re: Lucifer remailer)
by eli+＠gs160.sp.cs.cmu.edu 17 Dec '03

17 Dec '03

>Hm, is that Dr. John Grubor's domain (aga(a)dhp.com)? DHP is "The DataHaven Project", a local (Pittsburgh) ISP "dedicated to providing anonymous and/or private accounts for users." The egregious Law Doctor *could* be running the remailer, but there's no particular reason to think so. >That will make a nice anonymous remailer... NOT! Thank you. It might make a nice test case for the Pennsylvania anti-remailer law. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Re: Grubor remailer? (Was Re: Lucifer remailer)
by Alex F 17 Dec '03

17 Dec '03

> dhp is not "Grubor's domain," it's just a Pittsburgh ISP > with liberal terms of service (which is why it can run > remailers). Perhaps you're thinking of "manus.org"? > I thought that DHP is mostly Canadian. I know that Panzer deals w/ them & he is running from Pitt. but I think that the others are mostly from Canada. I work w/ a few of them, but they are not here to ask about this (at the moment. They just went out for dinner). I don't think that DHP (Data Haven Project) is really an ISP per se... =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

2 1

Re: Ga Law/No False Identity
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-06-27 17:15:15 EDT, nowhere(a)alpha.c2.org writes: >: It shall be unlawful for any person, ... to transmit any data >: through a computer network ... if such data uses any individual >: name, ... to falsely identify the person, ... >: >----------snip---------- >: -- Robert Costner >: Electronic Frontiers Georgia >: rcostner(a)intergate.net > >Spamming aside, this strikes at my privacy and choice of anonymity. > > falsely id a person?? Well it seems to me ya just wanna get the messages OUTTA there and arent trying to 'act' as that person in the sense that you are posing to NO person that you really are that person.

1 0