December 2003 - cypherpunks-legacy

IEEE newsletter on Security & Privacy
by Avi Rubin 17 Dec '03

17 Dec '03

This is to inform people who are interested of the IEEE Computer Society's Technical Committee on Security and Privacy's newsletter, CIPHER. The URL for the online version can be found at http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ There is also a text version of the newsletter mailed out to the mailing list about every two months. You can find subscription information as well as the current and back issues at the web site. Here is the table of contents of the April issue: ==================================================================== Newsletter of the IEEE Computer Society's TC on Security and Privacy Electronic Issue 27 April 27, 1998 Avi Rubin and Paul Syverson, Editors Bob Bruen, Book Review Editor Hilarie Orman, Assoc. Editor Mary Ellen Zurko, Assoc. Editor Anish Mathuria, Reader's Guide ==================================================================== http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ Contents: [3354 lines total] o Letter from the TC Chair o Letter from the Editor Final Program and Registration Information for the 1998 IEEE Symposium on Security and Privacy, Oakland California USA Preliminary Program of the 1998 IEEE Computer Security Foundations Workshop, Rockport Mass. USA Security and Privacy Survey by the IEEE Computer Society Security and Privacy News Briefs: o LISTWATCH: Items from security-related lists, by Mary Ellen Zurko o An Update from Asia, by Yongfei Han o Report on Canadian Crypto Policy Framework for Electronic Commerce, by Stewart Baker and Elizabeth Banker o More recent news on Canadian Crypto Policy Framework and other policy news o Denial of service attacks targeting Windows 95/NT machines o Employees buy ORA Canada Commentary and Opinion: Book Reviews o Web Security. A Step-by-step Reference Guide. by Lincoln Stein, reviewed by Bob Bruen Conference Reports: o Workshop on Education in Computer Security (WECS '98) by Cynthia Irvine o Computers, Freedom, and Privacy (CFP `98) by Danielle Gallo o Financial Cryptography (FC`98) by Paul Syverson o NSA Network Security Framework Forum (NSFF) by Jeremy Epstein Assessment of security software New reports available via FTP and WWW: a couple New Interesting Links on the Web Who's Where: recent address changes Calls for Papers: HASE, ACSAC, IEEE Internet Computing, Software Practice & Experience, JCS, ACM RBAC Reader's guide to recent security and privacy literature o Conference Papers: Paper lists for FC, NDSS, and Info. Hiding o Journal and Newsletter articles: several Calendar List of Computer Security Academic Positions, maintained by Cynthia Irvine Publications for sale -- CSFW proceedings available TC officers Information for Subscribers and Contributors ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

2 1

kid informers
by ddt＠lsd.com 17 Dec '03

17 Dec '03

http://www.odci.gov/cia/ciakids/aerial/index.html "Hi, kids! My name is Harry Recon, and this is my twin sister, Aerial. She's going to tell you about the History of the CIA in another section of the kid's page. We know some great books, too! Read all about it! My parents named me after President Harry Truman, who created the Central Intelligence Agency when he signed the National Security Act on Sept. 18, 1947. My family has always supported the Agency and its predecessor, the Office of Strategic Services (OSS), roosting wherever it was camped and keeping an eye out in defense of our country, too. In 1961, when the Agency moved from downtown Washington, DC, to Langley, Virginia, we naturally followed. My dad says that we Recons have been in the intelligence operations business throughout US history: With Paul Revere on his midnight ride. With Virginia Hall as she arrived in France during World War II. Winging along side the U-2 as it took off to gather overhead pictures. Let Aerial tell you more about where we live and work and about our family history." http://www.nytimes.com/library/national/042398cia-kids.html "This is not an effort to recruit," a spokesman for the spy agency emphasizes. "This is an effort to inform in a fun way." I wonder what genius came up with this idea.

2 1

Data Fellows Strikes a Major Deal
by Mia Westerholm 17 Dec '03

17 Dec '03

Data Fellows Ltd. Media Release For immediate release 28 April 1998 DATA FELLOWS STRIKES A MAJOR DEAL A Prominent Scandinavian Telephone Operator Invests in Data Security Helsinki, Finland, April 28, 1998 -- Data Fellows, a leading provider of Internet security solutions, has made a deal with the largest private telephone company in Finland. Helsinki Telephone Corporation has bought F-Secure SSH to enhance the security of its Kolumbus Internet services over public networks. Kolumbus is one of the largest providers of commercial Internet services in Finland. "Data security is a highly important consideration for us," says Mr. Vesa Perttunen, Development Manager from Helsinki Telephone Corporation, Kolumbus Services. "We evaluated the data security products available on the market, and F-Secure SSH was the best we could find. We particularly appreciated the fact that the source code is available to us." Says Mr. Tatu Vehmas, Sales Manager, from Data Fellows: "F-Secure SSH leaves no room for security compromises. Furthermore, it is the only sensible tool for secure remote systems administration currently available on the market. We are pleased that Kolumbus Services has chosen our unique F-Secure SSH package." The F-Secure SSH Package F-Secure SSH products are based on the SSH security protocol. The SSH protocol is an application level protocol with strong public key authentication and 128-bit encryption. It guarantees the simultaneous authentication of both ends of the connection, the secrecy of the transmitted information, and the integrity of the transmitted data. F-Secure SSH Terminal provides the user with secure login connections over untrusted networks. It acts as a replacement for the telnet protocol. F-Secure SSH Terminal fully supports VT100 terminal emulation. F-Secure Tunnel creates a local proxy server for remote TCP/IP services. The service can be one of the Internet protocols, pop, smtp (used by e-mail software), http (used by Web browsers), etc., or almost any other TCP/IP based service. The local proxy server listens for a socket on the desired port and forwards the request and data over the secure channel. It then instructs the F-Secure SSH Server to make the connection to the specified service on the remote machine. In addition to secure terminal connections and TCP/IP connection forwarding, F-Secure SSH Server provides tools to replace existing rsh, rlogin, rdist, and telnet protocols. These tools enable administrators to carry out all remote systems administration tasks over secure connections. About Helsinki Telephone Corporation Helsinki Telephone Corporation is the largest local, private telephone company in Finland. It is one of the cornerstones of the Finnet Group, a consortium of 46 private local telephone companies. Helsinki Telephone Corporation has expertise in the entire range of telecom services, from the fixed network through data services to mobile telephony. Through the Finnet Group, Helsinki Telephone Corporation provides services throughout Finland. It has also extended its services abroad through co-operative agreements with leading international operators. More information about Helsinki Telephone Corporation can be found at: http://www.hpy.fi More information about Kolumbus Services can be found at: http://www.kolumbus.fi More information about Finnet can be found at: http://www.finnet.fi About Data Fellows Data Fellows is one of the worlds leading developers of data security products with offices in San Jose, California and Espoo, Finland. Its groundbreaking F-Secure product family is a unique combination of globally available, strong encryption and revolutionary anti-virus software. The integrated F-Secure product range provides a complete security solution for enterprises, and includes file encryption and IPSec communication encryption products, VPN gateways, SSH based secure remote management software, and a full range of anti-virus products to workstations, servers and gateways. Data Fellows is also the developer of the award winning F-PROT Professional anti-virus, now part of the dual scanning engine concept of F-Secure Anti-Virus. Data Fellows is privately owned. Since it was founded in 1988, its annual net growth of net sales has been over 80%. Data Fellows offers a worldwide network of technical support, training and distribution in over 70 countries. Data Fellows belongs to an elite group of companies that have a triple-A rating from Dun&Bradstreet. More information about Data Fellows and its products can be found at: http://www.DataFellows.com For further information, please contact: Data Fellows Ltd. Mr. Tatu Vehmas, Sales Manager Tel. +358 9 859 900, Fax. +358 9 8599 0599 E-Mail: Tatu.Vehmas(a)DataFellows.com €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€ Mia.Westerholm(a)DataFellows.com http://www.DataFellows.com Data Fellows Ltd. PL 24 FIN-02231 ESPOO, FINLAND Tel. +358 9 859 900 Fax. +358 9 8599 0599

1 0

NASA 'educating' scientists to restrict free speech.
by Chris L. Kuszmaul 17 Dec '03

17 Dec '03

Hi, my name is Chris Kuszmaul. I am a contractor at NASA Ames research center. I feel it would be valuable for the general scientific community to be aware of some upcoming classes designed to educate scientists here regarding what they may and may not write on the internet, or any public forum. -------------------- begin excerpt -------------------- NASA has begun responding to recent new legislation and regulations regarding the export of information or material with potential use as a weapon of mass destruction or international business competitiveness advantage. All personnel creating information, equipment or material falling within this category are now responsible to control its transfer according to regulations. NASA has created an Export Control Administrator at each Center responsible to implement a program which provides for the review, classification and approval (or disapproval) of the export of material or information which may be subject to limitations. The Center has arranged for the outreach program offices of the U.S. Customs and the Bureau of Export Administration (BXA), U.S. Department of Commerce, to conduct a brief class on their Agency's regulatory requirements in partial fulfilment of this required training. Everyone is welcome to attend, but this is a mandatory briefing for researchers, engineers and equipment developers. This session will deal with the enforcement of the Export Administration Regulations (EAR), issues of the Commerce Control List (CCL), and Export Classification Control Number (ECCN). This particular session covers the regulatory requirement for the authors of scientific, technical materials and software developers. Anyone who generates and develops such materials, or sends NASA commodities overseas must attend this session. These specifically include NRC, Ames Associates, grant recipients, students, IPA's, contractors, civil service employees and all others who publish on behalf of NASA. The EAR, CCL, ECCN are important in completing block III of the Document Availability Authorization (DAA)(Form 1676). Each session will be approximately 15-20 minutes. A question and answer session will follow after the talk. The dates, time, and location are indicated below. Attendance at one session is sufficient to fulfill the regulatory requirements. Dates Time Location May 7, 1998 10 am Bldg. 213, Rm 261 .... --------------------------------------- As the text above says, everybody is welcome to attend. CLK

1 0

Re: NASA 'educating' scientists to restrict free speech.
by x 17 Dec '03

17 Dec '03

Thank you - chilling. Anyone have specifics on the "legislation"? and regulations, especially concerning "potential use as a weapon of ... international business advantage?" At 08:15 AM 4/28/98 -0700, Chris L. Kuszmaul wrote: > > > Hi, my name is Chris Kuszmaul. I am a contractor at NASA >Ames research center. I feel it would be valuable for the general >scientific community to be aware of some upcoming classes >designed to educate scientists here regarding what they may and >may not write on the internet, or any public forum. >-------------------- begin excerpt -------------------- >NASA has begun responding to recent new legislation and regulations >regarding the export of information or material with potential use as a >weapon of mass destruction or international business competitiveness >advantage. All personnel creating information, equipment or material >falling within this category are now responsible to control its transfer > >

1 0

Quantum Snooping
by John Young 17 Dec '03

17 Dec '03

New York Times' Markoff reports today on the latest in quantum computing, some of which was discussed here recently. Two points of note: IBM recently made a "snapshot" of the entire worldwide Web, eight trillion bytes of data, for an experimental database for searching and unnamed other manipulation by its quantum computers. Searching the database for a word by conventional computers would take a month, while quantum devices could do it in 27 minutes, a Beamer says. NSA is funding quantum computing at Los Alamos specifically for cryptographic investigation, "because QC could have a profound effect on modern cryptography." Others forms of warp speed snooping are discussed as well. --------- Restricted: "Snow Crash" is featured in a hot-selling book on the thought of the American Left, "Achieving Our Country," by philosopher Richard Rorty. The book is swell reading on the state of US thought, culture and politics whatever your disagreeable attitude. It's smallish, but for those completely broke and open to copyleft, grab it before IBM kicks it offshore: http://jya.com/161.htm (238K) http://jya.com/161.zip (89K)

1 0

hacking smartcards
by Ken Williams 17 Dec '03

17 Dec '03

Hello, http://cuba.xs4all.nl/~hip/ nice info, ideas, and website. Regards, Ken Williams ORG: NC State Computer Science Dept VP of The E.H.A.P. Corp. EML: jkwilli2(a)adm.csc.ncsu.edu ehap(a)hackers.com WWW: http://152.7.11.38/~tattooman/ http://www.hackers.com/ehap/ PGP: finger tattooman(a)152.7.11.38

1 0

Re: Gary Lee Burnore and His Anti-Privacy Zealots are on the Warpath!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William J. McClatchie <wotan(a)databasix.com> wrote: > >Anti-privacy kooks like you and DataBasix CEO Gary Lee Burnore are one of > >the best arguments for the existence of anonymous remailers. You and your > >friends at DataBasix have a hard time bullying and harassing people into > >silence that you can't identify, don't you? > > And assholes like yourself are the best argument for *banning* remailers. > They serve a purpose. Unfortunately, to meet the purpose means that > assholes are also given access to the service. Your own record of harassing remailers is well known, McClatchie. Calling remailer users "assholes" and calling for content-based censorship only underscores your anti-privacy agenda. If remailer users posted only what was popular and politically correct, there would be little need for remailers. One remailer operator who was forced to shut it down mentioned your name quite prominently, BTW, in providing details about the attack. > It was someone using a remailer to harass Wells Fargo management. Can you document this? I never read a single post from anyone claiming to speak for Wells Fargo management which has substantiated this. Nor did any of the remailer operaters involved mention having received such an official complaint from member of Wells Fargo's management. So all we have is you parroting Burnore's original unsubstantiated allegations. Isn't it interesting that when something offends Gary Burnore he often resorts to "defending" phantom victims of the alleged "abuse"? And shortly thereafter, various of his sock puppets echo his whining chant. > It was someone using a remailer who has spambaited several hundred > email addresses. And one such post contained Gary Burnore's own .sig block still appended to an otherwise anonymous post. Oops! > It was someone using a remailer who wants to know if Gary Burnore's > current employer knows of his background. And if not, how could they > be contacted. > > It was someone using a remailer who posted, in direct violation of NC law > information in its registry for the sole purpose of harrassing someone. Please cite the NC law which you claim is being violated, and how it would apply to a remailer located outside of NC? Would you also say that remailers ought to censor their content to avoid other laws being broken, such as insulting the religion of Islam, publishing information about birth control, abortion, etc.? If not, why should a foreign remailer selectively enforce this one law in NC (if it even exists)? Telling people that the website exists and that a search for "Gary Lee Burnore" on it might yield a match is not more "harassing" than the site itself. If they didn't want people to access this data, why publish it on a public website? The whole purpose of the website it apparently to let people to know who the registered sex offenders are in NC and where they live. If someone snail mailed you something you considered "harassing" and included no return address, would you accuse the sender of trying to get the postal service shut down? Wow, McClatchie. I guess you have a point. If you and Gary claim that all that happened, and that it was done by someone outside of DataBasix, then I guess we should believe it and shut down all the remailers just to make sure they aren't abused... But the fact is that all too often in the past, designer "abuse" would just automagically appear at critical times when Gary Burnore and Belinda Bryan were making demands (privately, via e-mail) on another remailer operator. How would someone outside of DataBasix have known that? How would someone other than a DataBasix insider have gotten access to the complete list of DataBasix' clients and employees in order to allegedly "spam bait" them, as Belinda claimed? Your own involvement in all of these attacks seems to more than just coincidental. Speaking of abuse and harassment, Gary Burnore demanded that Jeff Burchell turn over to him all of his remailer logs containing the e-mail addresses of everyone who had either sent or received anonymous e-mail through the server. Yet Gary refuses to disclose how such a list would have been used. Fortunately for the remailer user community, no such data was ever collected. > >Lest anyone forget, Gary launched his first tirade against anonymity when > >someone tipped off his molestation victim's mother and school officials > >anonymously. > > No, one of his first complaints about remailers was after someone used one > to harass his SO of the time, and her daughter. They had committed the > heinious crime of knowing Gary. Most women would not consider it "harassment" to be informed that their daughters were being molested. Nor did she complain. Gary did! How nice of the perpetrator to be so considerate of his victim's mother and not want to have her "harassed" by knowledge of what Gary was doing to her daughter. Ignorance is bliss, huh? Gary's motives were finally revealed when he was CONVICTED for that very crime. How would a random harasser have even known of Gary's sexual activities involving minors, before he was arrested and convicted? How would he/she know the victim's gender, age, identity, and city of residence? > >Whistleblowing has always been one of the important functions > >of anonymous remailers. > > Uh huh. And we've seen real "whistleblowing" activity here. Apparently so, when the perpetrator of the crime is the only one who complains about being exposed. In case it has escaped your attention, Gary complained PUBLICLY about a PRIVATE e-mail message to his victim's mother. If telling a mother that her daughter is being molested isn't whistleblowing, what is? > Seen plenty > of abuse. Seen postings of such a vile nature from remailers that when > people made similar postings from traceable accounts, their ISP's > terminated them. And it was not becuase of content - but becuase the > messages were harassing, in both nature and intent. TRANSLATION: Anything with which the fine folks at DataBasix disagree tends to be called "harassment" and "abuse". As for intent, the accuser has the burden of proof, there. But consider this: if even mentioning Gary's sexual activities with minors is "vile", what does that make Gary for actually committing them?

1 0

Your Opinion Matters...
by Eat Shit 17 Dec '03

17 Dec '03

I think I should walk into a Luby's Cafeteria and start blowing people away at random, for no good reason. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should go down to a local school and start randomly slaughtering the children. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should monitor the electronic communications of every person on the face of the earth, in order to protect them from themselves. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should attempt being elected the leader of the most influential country in the free world, by kissing the asses of the money and power mongers. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT NOTE: If you don't have a phone, you become a guest on a TV talk show where I am appearing, and cheer or boo me, according to your wishes. Remember: Your opinion matters...NOT! EatShitMonger

1 0

Wiretap Docs
by John Young 17 Dec '03

17 Dec '03

Cellular Telecommunications Industry Association suit against the FBI over disputed wiretap requirements of CALEA: http://jya.com/ctia-fbi.htm (19K) The FBI's definition of "upgrade" and "modification" for CALEA wiretap requirements, Federal Register, April 28, 1998: http://jya.com/fbi042898.txt (60K)

1 0