December 2003 - cypherpunks-legacy

Re: Dialogue ------ Space Aliens Hide My Drugs!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

ROTFLMAO! "Ask not who your country can Nuke for you...ask who you can Nuke for your country." ~ Timothy C. McKennedy, President of Samsonite Peripherals, Inc.

1 0

I Can't Help Myself...
by Toto 17 Dec '03

17 Dec '03

!OB Crypto: I crossed the US border today to make a beer run, and a US Customs officer who has known me for decades took the time and trouble to 'roust' me, as per the instructions of his superiors. The last words out of his mouth were a question to which he has long known the answer: "Where were you born?" I was born in Liberal, Kansas. Could it possibly be that this fairly decent individual, who has never done me serious dirt, even when it would have resulted in career advancement, is a Secret SypherPunk delivering a cryptic message that could be translated as, "Toto...I don't think you're in Kansas, anymore."? DrunkOnCheapAmericanBeerMindsWantToKnowMonger

1 0

Refutation of 'Magical Thinking'
by Toto 17 Dec '03

17 Dec '03

I decided to do an objective experiment to prove or disprove the validity of 'Magical Thinking'. I shut my eyes and concentrated on psychically willing my TV to provide me with an indisputably meaningful message relevant to my life. I turned on the TV, to a random channel, just in time to see/hear Dorothy and the ScareCrow singing, "If I Only Had A Brain." Conclusion: Magical Thinking is BullShit!

1 0

Opentown proudly announces 50,000 membership Anniversary Giveaway Festival
by postmaster＠mail.opentown.com 17 Dec '03

17 Dec '03

50000Èž¿ø µ¹ÆÄ±â³ä »çÀº ŽëÃàÁŠ! http://www.opentown.com ¿ÀÇÂÅž¿îÀÌ ¿©·¯ºÐÀÇ »ç¶û¿¡ ÈûÀÔŸî 5žžžíÀÇ Èž¿øÀ» °¡ÀÔÀ¯Ä¡ÇÏ¿ŽœÀŽÏŽô. µû¶óŒ ¿©·¯ºÐÀÇ Œº¿ø¿¡ ºžŽäÄÚÀÚ ÇªÁüÇÑ °æÇ°°ú ÇÔ²² 3°¡Áö Å«Çà»çžŠ ž¶·ÃÇÏ¿ŽœÀŽÏŽ Ù. Çà»ç±â°£ : 98.5.7 ~ 6.5 (30ÀÏ°£) ¡Ú Çà»ç 1. °ÔÀÓ ¿ìŒöÀÚ »çÀº ŽëÃàÁŠ ŒŒ°è¿¡Œ ÇÑ°³»ÓÀÌ Æ¯º°ÇÑ œœ·ÔžÓœ®À» Áñ±âœÃžç 30ÀÏ°£ °ÔÀÓÇÑ °á°úÁß ÃÖ°í Á¡ŒöžŠ ŸòÀº »óÀ§ 1,000ží¿¡°Ô µðÁöÅÐÄ«žÞ¶ó, PCSÈÞŽëÆù, MGM¿Àž®Áö³¯ Ä«Áö³ëÄš ¿Œè°íž®, ¿ÀÇÂÅž¿î Ä«Áö³ë žðÀÚ, ±âÅž ÇùÂù»ç °æÇ°µîÀ» ¹«·á·Î ÁõÁ€ ÇÕŽÏŽÙ. ¡Ú Çà»ç 2. ÃÖŽÙ Èž¿ø°¡ÀÔ ÃßÃµÀÚ »çÀº ŽëÃàÁŠ Çà»ç±â°£ µ¿ŸÈ œÅ±Ô Èž¿øÀ» ÃÖŽÙ·Î °¡ÀÔ ±ÇÀ¯ œÃÅ² Èž¿ø 5ží¿¡°Ô °¢°¢ PCSÈÞŽëÆù 1ŽëŸ¿À» ÁõÁ€ ÇÕŽÏŽÙ. ¡Ú Çà»ç 3. žÅ 5,000žíÂ° œÅ±Ô°¡ÀÔ Èž¿ø Çà¿î ŽëÃàÁŠ œÅ±Ô °¡ÀÔ ÇÏœÅ Èž¿øÁß žÅ 5,000¹øÂ° Èž¿ø ¿¡°ÔŽÂ °¢°¢ PCSÈÞŽëÆù 1ŽëŸ¿À» ÁõÁ€ÇÕŽÏŽÙ. »çÀºÇà»ç¿Í ŽõºÒŸî Ä«Áö³ë°ÔÀÓµµ ¹«·á·Î Áñ±âŒŒ¿ä. ·ê·¿, µå·Î¿ìÆ÷Ä«, ºí·¢Àè, ¹ÙÄ«¶ó, œœ·ÔžÓœ®, °íœºÅé°ÔÀÓÀÌ ŒºñœºÁß¿¡ ÀÖÀžžç Çà»çœÃÀÛ°ú ŽõºÒŸî µ¹ÀÌÁþ°í¶¯, Å°³ë, Ä«ž®ºñŸÈÆ÷Ä«, ÈŠŽýÆ÷Ä«°¡ Ãß°¡·Î ŒºñœºµËŽÏŽ Ù. ¿ÀÇÂÅž¿îžžÀÇ µ¶Æ¯ÇÑ ÀÚ¹ÙÃ€ÆÃµµ ÁØºñµÇŸî ÀÖœÀŽÏŽÙ. »öŽÙž¥ Ã€ÆÃÀÇ ¹Š¹ÌžŠ ŽÀ²žºžŒŒ¿ä. Good Luck!

1 0

U.S. Navy caught hacking into British marine charity Web site
by Spam the President 17 Dec '03

17 Dec '03

http://www.infoworld.com/cgi-bin/displayStory.pl?98058.winavy.htm U.S. Navy caught hacking into British marine charity Web site By Kristi Essick InfoWorld Electric Posted at 3:07 PM PT, May 8, 1998 The U.S. Navy has been caught attempting to break in to secure areas of a World Wide Web site sponsored by a U.K. marine-mammal preservation charity, according to officials at the organization. The Whale and Dolphin Conservation Society (WDCS) -- which operates an online shopping site aimed at generating money for the welfare of the animals at http://www.wdcs-shop.com -- said it was alerted to the attempted break-in last week by its site-hosting company, Merchant Technology Ltd. "We were working late one night, and a command line request came in wanting to access unauthorized areas of the site," said Andy Fisher, marketing manager for Merchant. "We were amazed to find out it was the Pentagon." Merchant built and manages the secure electronic-commerce site for the conservation society and routinely keeps an eye on who visits. If users attempt to gain access to unauthorized areas, the company is alerted to the source of the incoming request. At 9:45 p.m. GMT on April 28, Fisher said, workers at Merchant were shocked to see an incoming attempt to breach security by a user identified as donhqns1.hq.navy.mil. Merchant got in touch with WDCS immediately, only to find out that the charity had been contacted by the Navy a few weeks earlier. The Navy was interested in obtaining a report the group is working on that details the efforts of Russian animal experts to train dolphins in the Black Sea for military tasks, such as finding and attaching probes to submarines, Fisher said. A WDCS representative said that there is nothing secret about the Russian government's activities in this area but that the document does contain information about the export of the trained dolphins to foreign countries. The group declined to give the Navy a copy of the report only because it was not complete at the time. Once it is made final, the report will be published and the Navy can then examine it, the representative said. The WCDS said that it is confused about why the Navy would attempt to break in to its Web site. "I think whoever it was within the U.S. Navy facility would have better things to do rather than try and hack into our computers," said Chris Stroud, the organization's director of campaigns, in a statement. "If they were seeking reports on the Black Sea, we shall be freely publishing these in the near future anyway." The WCDS previously has commented unfavorably on Navy activities such as its low-frequency sonar trials off Hawaii and on ship collisions with endangered whales, the group said. Merchant says it is "100 percent sure" the hacking attempt originated from the Navy. WDCS has notified the U.S. Embassy in London and the relevant U.K. authorities, the organization said. "We hope that the U.S. authorities have some rational explanation for this incident," Stroud said. "The Navy has not yet received a formal complaint on the issue," said a Navy official, who declined to be named. "Until the Navy receives a formal complaint with details, there's not much we can do to proceed further." Merchant Technology Ltd., in Bath, England, can be reached at 44 (1225) 481 015. The Whale and Dolphin Conservation Society, also in Bath, can be reached at 44 (1225) 334 511 or http://www.wdcs.org. Kristi Essick is a London correspondent for the IDG News Service, an InfoWorld affiliate.

2 1

db$: Digital Bearer Settlement Conference Status Report
by Robert Hettinga 17 Dec '03

17 Dec '03

I suppose all of you have figured out by now what we're not doing a Digital Bearer Settlement Business Development Conference at Bretton Woods this August. :-). I was willing to give it a shot, even with the admittedly high cost in hotel rooms, if I could get presenters on the topics I wanted. If I got the presenters, I could use the content to leverage the keynote speakers, and, with those, I think I would have gotten the attendance. Unfortunately, I couldn't find anyone, with exactly two exceptions, who both knew enough on the topics I was soliciting and who had the time to come to Bretton Woods. In the process of figuring out all that out, however, something entirely different presented itself, and thinking about *that* gave me another set of conference ideas, which I want to bounce off you guys in just a bit. I suppose don't really give up on ideas once I get them, though they may get pushed down on the stack for a while. It's that Frisian expression of the berserker gene thing, I guess... :-). So, I was figuring out how I could sweeten the pot for presenters for the Bretton Woods thing, when I bumped into the editor of a well-known book :-). This got me to thinking about a book on digital bearer settlement, containing the contents of this summer's proposed conference, written in chapters by the presenters of the conference. I talked to the editor about this, and she said that she didn't like books written by a cast of thousands, and since we were talking about new technology with no user base and she was a technical and professional books editor, she was going to have a hard time selling something like this to her market. However, if a single person wanted write a book on digital bearer settlement, it seemed like there might be more room to bash it into something her audience might want to read. Since *I* didn't want to write a book, really, we sort of left it at that. About a week or two later, Pete Loshin, who now works as an editor for Cutter Publications, invited me to come and stir things up at their "Summit" conference, and sit on an internet commerce panel, which I've already told you the story about. While there, however, I talked to several authors of books, and one of them, a pretty well-respected author of hard-core IT computer books, told me that my whole geodesic society / digital bearer settlement thing was something actually new to him, and that he so rarely heard something new in his business. So, he encouraged me to get started on a "trade" book, one for the general public, and spent about an hour telling me how to get started. So, when I got home, all excited, and I started bashing away on the popular book I've been threatening to write for years on all this stuff. Unlike a technical and professional book, the typical first author doesn't get advances for this kind of thing, so you have to write the whole thing in advance and see what happens. So, we'll see what happens. And then, something wierd happened. Kieth Dawson's TBTF newsletter did a bit on me, Philodox, the dbs list and the conference, and, out of that, I got email from *another* well-known editor asking me if I knew anyone who wanted to do a book on micropayments or something. So, I got this guy on the phone, cranked up the reality distortion field to 13 (monkeys flying), and pitched him on a book on digital bearer settlement, using the content request from the Bretton Woods conference call for presenters as a jumping off point. He then asked me if I could do something a little more polemical :-), and I sent that version off, but I think I scared him away. :-). I haven't heard back from him, and I suppose he lost interest. However, Tuesday, I met up with the original famous-book editor, the one I was trying to pitch the conference book to, and told her what I had done with the *other* editor on a digital bearer settlement book, and she wanted to see it. She liked the first, unpolemic, version best, :-), and we're still talking, which is a good sign. So, all of this got me to thinking about how I want to proceed with my proposed conference schedule. I still want to do a conference this summer. Some kind of "gathering of the clan" thing on the same order as the mac-crypto conferences Vinnie and I do, but, of course, I have to make money on it. Essentially, I'd put out an open call for papers/presenters, bunch them together on the schedule together roughly by content, and call it a program, just like I do for mac-crypto. I wouldn't be reimbursing speakers or anything. People who speak pay to see the rest of the conference, in essence, just like they do at FCxx After that, I'd start working on putting together a peer-reviewed conference, hopefully in New York, but maybe Washington, where I'd had a tentative offer. The problem with the Washington offer is that it's at a university and I have to make money on this. I'm not a sinecured academic ;-), or even someone who has a day job. :-). That was the problem with IFCA's takover of FCxx, the upside kind of went away for me. Oh, well, at least I get credit for the idea. And three more trips to wherever the conference goes as a member of IFCA's board. Anyway, this doing conferences for profit is also why I can't use a university location in the Boston area for this digital bearer settlement developer's conference as well. Finally, I'd still like to go to Bretton Woods again, but *next* summer, and with a Workshop, with paid *paid* presenters, which is what this summer's business development conference should have been all along. Maybe, if I'm lucky, and the digital bearer settlement book's out, it'll be the text book for this thing, or something. So, let's look at this "gathering of the clan" idea first. Because of all the problems people had with the prices at Bretton Woods, I started thinking of all kinds of ways to do it on the cheap. Stuff like renting the Sons of Italy Hall here in Roslindale, my Boston neighborhood. Which is not as dumb to do as it was, say, two years ago. The crime rate in Boston, especially Roslindale/Hyde Park, which is now the mayor's neighborhood, has fallen rediculously lately, and Roslindale's undergoing a boomlet of sorts, with lots of new businesses, including a couple of proto-bohemian cafes, a new grocery store, stuff like that. The neighborhood is scruffy and full of new immigrants and said freshly-installed bohemians, and a digital bearer settlement conference here would feel about the same in terms of culture-clash as FC98 was on Anguilla, which would be kind of cool. I think I could get a couple of phone lines in to the hall, and, if I dropped a couple of routers and 56k modems on them, I could get better bandwidth than we had in Anguilla, even. ;-). Of course, Roslindale in mid-July or early August is not quite Anguilla in February, but, I still think it would have the same foriegn-place *extremely* casual atmosphere. No beach, much less total eclipse off the Montserrat Volcano, of course, but, well, you get the point: "Hackers invade Roslindale. Film at 11." The local business development association would probably love me for it, probably as much as the Anguillans love Vince for FCxx, which, of course, would have its attractions for me as a local resident. However, I still haven't talked to the manager of the hall, and I'm not sure the place has air-conditioning (it has to, right?), much less telephone lines, much less touchtone lines. Seriously. Not to mention that I'd be hanging myself out to dry on deposits, and stuff, if nobody showed up. Much less that I'd have to collect checks from people up front before I could even make reservations for all this stuff. Having a credit card merchant account would be nice, but it's still impossible at the moment. Thinking about this very problem, I sent feelers out at this month's DCSB meeting for the use of a company's net-wired auditorium-seating conference room instead, to see if I could get it by way of sponsorship of the conference. This would also reduce costs a bunch, but I haven't heard from anyone on this, so it's probably a long shot at this point. But, then, after DCSB that day, I was talking to the catering manager at the Harvard Club, and, just as a kind of pro-forma thing, I asked him for a small 2-day conference estimate for, say, 30-35 people. Because of all the business I bring him with DCSB, he quoted me something which was rediculously low in terms of my own financial exposure if things went south. It's not like the Club is busy in the summer, when all the bankers and lawyers go off to places like the Cape and the Vinyard anyway, so he sees me as a safe way to get some new business in the door. And, since the Club function rooms aren't booked up this time of the year, I could cancel anytime up to a week in advance of the date if my attendance wasn't enough, because I'd be bringing him "found money" anyway. So, for about half the price of attending any business conference in a downtown conference hotel, we could have something really nice in the Harvard Club, 38 stories up, with harbor views, decent food, and comfortable surroundings to schmooze in. There's the complication of the jacket requirement, but, if we started on Thursday, Friday's a "business casual" day, so we'd have only one day of dress code to contend with. In addition, I think dbs and dcsb folks, as more business and finance oriented types, are more inclined deal to a single "dress-up" day than just plain crypto folks, so I think this could wash. The price for a Harvard Club version of, what?, "Digital Bearer Settlement Developer's Conference", "Symposium?", whatever, including Net access like we had at FC98, and A/V, and maybe video/audio taping or even netcasting, if I can get the rights hocked off for a percentage or something, would be on the order of $400 per person, including breakfast, lunch, and a cocktail party the first night, and of course, paying me. :-). Getting lodging would be up to you, but at least you're not locked into a $400/night room like we were at Bretton Woods. I would bet most folks could find friends to crash with, if it came to that. I haven't priced the "Hackers Invade Roslindale" option, but I'd be happy to do that instead if there's real interest in it. I'd just need to collect money from people almost immediately to get started. Frankly, I like either option. They both sound cool. I'm thinking about July 23-24 at the moment. In the same spirit of "first-ever, last-minute" that we did mac-crypto in, of course. So, folks, what do we want to do? Contact me directly if you have questions on what particulars there are at the moment, or, especially, if you want to speak at this thing. If there's interest coalescing around one idea or another, I'll put out a "formal" call for presenters pretty soon. Also, if you want to chat publically about this conference or digital bearer settlement in general, I figure the dbs(a)philodox.com list is the best place to do this. It keeps the cross-posting and off-topic stuff on other lists to a minimum. Here's the URL to subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

1997 Wiretap Report
by John Young 17 Dec '03

17 Dec '03

The US Courts 1997 Wiretap Report is out: http://jya.com/wiretap97.htm Total: 1,094, up 59 from 1996; 206 "electronic." 374 taps in this nabe; dozens in this bldg, six in this flat, a couple on this box, one under lip counting morse teethgrinds.

2 1

What Bill Gates doesn't want you to know.
by diane＠extractorpro.net 17 Dec '03

17 Dec '03

Microsoft is on to something that may in fact smash their competition with hours! Bill Gates and his team of marketing VPs have finally found the net's biggest secret. The one that Web Masters and Small Businesses have been using to get the lion's share of business out there. You see, they all have found a way to reach more people than even all of Microsoft employs with the press of one button-- and at a cost that is less than you will probably spend on internet access this year. Its called Direct Email and its already in the works with companies like Microsoft. Bill Gates' dream is already here with a secret piece of software called "Extractor Pro". Extractor Pro already does what Bill Gates is waiting to do! Armed with Extractor Pro, a pentium computer, and a 28.8 modem you can be sending more messages in the time that it takes to change the oil in your car, than the entire NewYork post office can send in one day.. Thousands of simple Email messages like this could be your ticket to the moon. If you want to be one up on Bill Gates and his team of marketing VPs, call us or visit: http://www.extractorpro.net/~diane/ We'll throw you the keys to Extractor Pro and let you take it for a test drive. After you've gone around the block a few times and decided Extractor Pro can do for you what Bill Gates' latest plan can do for Microsoft-- call us and we can unlock your Extractor Pro right over the net. Thank you for your time. Extractor Marketing 1-734-728-5210 ********************************************************************* * The mailing list for this message has been pre-processed by an * * independent service to remove the addresses of those who are * * not interested in unsolicited email. Free registration for this * * removal service is at http://www.extractorpro.net * * * *********************************************************************

1 0

corvette.bxa.doc.gov followup
by mgraffam＠mhv.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This message describes a computer on the Internet, one corvette.bxa.doc.gov (192.239.70.124) (hereafter corvette). This computer is owned by the Bureau of Export Administration (hereafter BXA), which itself is a branch of the Dept. of Commerce. Here I am exploring the idea that corvette runs a bot that scans the internet for materials regarding crypto export violation, and I will raise a few questions in regards to this. - From the BXA web page (www.bxa.doc.gov) The Bureau of Export Administration enhances the nation's security and its economic prosperity by controlling exports for national security, foreign policy, and short supply reasons. We administer the Export Administration Act by developing export control policies, issuing export licenses, and prosecuting violators. Additionally, BXA enforces the EAA's antiboycott provisions. A traceroute (timings excluded) from my computer system (a SLIP/PPP dialup to MhvNet, located in Poughkeepsie NY) to corvette yields: 1 annex1 (199.0.0.10) 2 router.mhv.net (199.0.0.1) 3 sl-gw8-pen-3-4-T1.sprintlink.net (144.228.160.41) 4 sl-bb1-pen-9-0-0.sprintlink.net (144.228.60.11) 5 144.228.180.10 (144.228.180.10) 6 nyc4-br2.bbnplanet.net (4.0.2.178) 7 nyc4-nbr2.bbnplanet.net (4.0.5.29) 8 vienna1-nbr2.bbnplanet.net (4.0.3.129) 9 vienna1-nbr3.bbnplanet.net (4.0.5.46) 10 washdc1-br1.bbnplanet.net (4.0.1.89) 11 washdc1-cr1.bbnplanet.net (4.0.1.174) 12 docosesa.bbnplanet.net (192.221.253.3) 13 corvette.bxa.doc.gov (192.239.70.124) It is especially useful to notice hops 10 and 11. The names of these two hosts seem to indicate that the hops have tended towards Washington DC. BBNPlanet is located in Washington, so it is probable that corvette is too (though this is not necessarily true). On April 22nd 1998, an anonymous connection was made from corvette to my personal computer, ismene. This connection is only possible through my main web page which is located on spice.mhv.net, which then links to my computer. This mechanism is needed because ismene gets a dynamic IP. Spice's logs show: corvette.bxa.doc.gov - - [22/Apr/1998:14:05:49 -0400] "GET /~mgraffam HTTP/1.0" 302 - corvette.bxa.doc.gov - - [22/Apr/1998:14:05:50 -0400] "GET /~mgraffam/ HTTP/1.0" 200 2019 corvette.bxa.doc.gov - - [22/Apr/1998:14:06:16 -0400] "GET /~mgraffam/misc/access.html HTTP/1.0" 200 629 The connector from corvette directly targeted my homepage, and then immediately went to the page that accesses ismene. The connector bypassed a page about crypto titled "Cryptotechnic Enlightenment". It is, perhaps, this odd combination of words that escaped a bot's notice, but would have surely been noticed by human. Instead the alleged bot picked up on "access.html" and left links to my RSA and PGP public keys untouched. If corvette is running a bot, it seems probable that they would ignore PGP keys because they surely generate a large amount of noise when exploring things of a cryptographic nature. This may account for the behavior. The access.html on spice has links to my computer. HTTP, FTP and telnet links are established, and direct links are made to copies of my public keys. The first three links to my keys via FTP are bypassed, and a connection is made via HTTP to my computer (ismene). The portions from ismene's httpd log follow: corvette.bxa.doc.gov - - [22/Apr/1998:13:58:51 -0400] "GET / HTTP/1.0" 200 1858 corvette.bxa.doc.gov - - [22/Apr/1998:13:59:48 -0400] "GET /crypto_index.zip HTTP/1.0" 200 19570 Corvette picks up the crypto_index.zip file, and leaves links titled "Index of unfinished works" and "Misc. projects". That corvette picked up the crypto_index.zip file establishes that it is looking for crypto related material. Why did it pass up the "Cryptotechnic Enlightenment" page then? I submit that it is because the word "cryptotechnic" did not trip the bot's sensor but the word "crypto" in the link title to crypto_index.zip did. I also believe that a human would have followed the "unfinished works" or "misc projects" links after getting a crypto index file. A human would be intelligent enough to intuit the connection; a spider is not. At this point, I imagine the bot reaching the end of ismene's main page, having picked up the file it thought was useful and returning back to the access.html file on spice and traversing to the next link. In this case, it is an ftp connection to my machine. A portion of my logs: Apr 22 14:00:13 localhost opieftpd[1509]: connect from firewall-user(a)192.239.70.124 Apr 22 14:00:14 localhost ftpd[1509]: connection from corvette.bxa.doc.gov at We d Apr 22 14:00:14 1998 Apr 22 14:00:15 localhost ftpd[1509]: Anonymous FTP connection made from host corvette.bxa.doc.gov. Apr 22 14:00:16 localhost ftpd[1509]: ANONYMOUS FTP login from corvette.bxa.doc.gov with ID mozilla@ After logging in corvette issues the following commands: Apr 22 14:00:22 localhost ftpd[1509]: <--- 200 Type set to I. Apr 22 14:00:23 localhost ftpd[1509]: command: SIZE /^M Apr 22 14:00:23 localhost ftpd[1509]: <--- 550 /: not a plain file. Apr 22 14:00:25 localhost ftpd[1509]: command: CWD /^M Apr 22 14:00:25 localhost ftpd[1509]: <--- 250 CWD command successful. Apr 22 14:00:28 localhost ftpd[1509]: command: LIST^M Apr 22 14:00:29 localhost ftpd[1509]: <--- 150 Opening BINARY mode data connection for /bin/ls. Apr 22 14:00:29 localhost ftpd[1509]: <--- 226 Transfer complete. Apr 22 14:00:35 localhost ftpd[1509]: command: PORT 192,239,70,124,7,228^M Apr 22 14:00:35 localhost ftpd[1509]: <--- 200 PORT command successful. Apr 22 14:00:36 localhost ftpd[1509]: command: SIZE /pub/^M Apr 22 14:00:36 localhost ftpd[1509]: <--- 550 /pub/: not a plain file. Apr 22 14:00:39 localhost ftpd[1509]: command: CWD /pub/^M Apr 22 14:00:39 localhost ftpd[1509]: <--- 250 CWD command successful. Apr 22 14:00:40 localhost ftpd[1509]: command: LIST^M Apr 22 14:00:40 localhost ftpd[1509]: <--- 150 Opening BINARY mode data connection for /bin/ls. Apr 22 14:00:40 localhost ftpd[1509]: <--- 226 Transfer complete. Apr 22 14:00:47 localhost ftpd[1509]: command: PORT 192,239,70,124,7,235^M Apr 22 14:00:47 localhost ftpd[1509]: <--- 200 PORT command successful. Apr 22 14:00:48 localhost ftpd[1509]: command: SIZE /pub/skey/^M Apr 22 14:00:48 localhost ftpd[1509]: <--- 550 /pub/skey/: not a plain file. Apr 22 14:00:50 localhost ftpd[1509]: command: CWD /pub/skey/^M Apr 22 14:00:50 localhost ftpd[1509]: <--- 250 CWD command successful. Apr 22 14:00:51 localhost ftpd[1509]: command: LIST^M Apr 22 14:00:51 localhost ftpd[1509]: <--- 150 Opening BINARY mode data connection for /bin/ls. Apr 22 14:00:51 localhost ftpd[1509]: <--- 226 Transfer complete. Apr 22 14:01:08 localhost ftpd[1509]: command: PORT 192,239,70,124,8,1^M Apr 22 14:01:08 localhost ftpd[1509]: <--- 200 PORT command successful. Apr 22 14:01:08 localhost ftpd[1509]: command: SIZE /pub/skey/README^M Apr 22 14:01:08 localhost ftpd[1509]: <--- 213 1149 Apr 22 14:01:09 localhost ftpd[1509]: command: RETR /pub/skey/README^M This series of commands ignores a directory called "keys" at root level, which is consistent with ignoring PGP keys above, and cd's to pub/skey. It then retrieves the README file (which is just a copy of NRL's readme) and leaves. The connection style itself (of SIZE'ing directory names) is odd, but this can be recreated with older versions of Netscape Navigator. I will assume that these connections are really from Netscape, and _not_ from a bot disguising itself as NS Navigator. Greg Broiles (gbroiles(a)netbox.com) forwarded portions of his logs on parrhesia to me: corvette.bxa.doc.gov - - [20/Mar/1998:10:18:07 -0800] "GET /wassenaar/ HTTP/1.0" 200 2253 "http://search.excite.com/search.gw?collection=web&display=html2,lb&search=w assenaar+countries" "Mozilla/2.0 (compatible; MSIE 3.02; Windows 3.1)" corvette.bxa.doc.gov - - [20/Mar/1998:10:18:46 -0800] "GET /wassenaar/ HTTP/1.0" 200 2253 "-" "Mozilla/2.0 (compatible; MSIE 3.02; Windows 3.1)" These shows connections from MSIE, can anyone confirm that MSIE makes FTP requests in the same manner as NS? Here I raise two questions that I would like to discuss, in private email if needed because it is off-topic. First, could Navigator be made to crawl the web? Could it be programmed via OLE, or Java? If it could, then it could easily be used as the protocol frontend to a spider that could easily crawl http, ftp, gopher, and news references looking for crypto export violations. If programming Navigator would entail pushing keystrokes into the keyboard buffer and simulating mouse events, I do not believe it would be used as tying up a machine's console in this manner would be vastly inefficient and it would be better justified to pay a programmer to develop the software to do it without NS. Now I would like to focus on a different aspect of my logs: the identification of a firewall-users(a)192.239.70.124. It seems as if corvette is a proxy server for other machines. A port probe of corvette yields the following services: corvette.bxa.doc.gov ftp 21/tcp corvette.bxa.doc.gov smtp 25/tcp mail corvette.bxa.doc.gov whois 43/tcp nicname corvette.bxa.doc.gov gopher 70/tcp corvette.bxa.doc.gov finger 79/tcp corvette.bxa.doc.gov www 80/tcp http ismene:~$ finger @corvette.bxa.doc.gov [corvette.bxa.doc.gov] Finger from your system is not permitted through the firewall. ismene:~$ ftp corvette.bxa.doc.gov Connected to corvette.bxa.doc.gov. 220-Proxy first requires authentication 220 corvette.bxa.doc.gov FTP proxy (Version 3.2) ready. - From these two connections, we can see that corvette is indeed a firewalling proxy. Because of this, we cannot be sure if all connections out of corvette belong to the possible spider. An altavista search for corvette.bxa.doc.gov turns up the web statistics logs of several servers, including military and foreign servers. Such a bot may crawl foreign servers looking for links or files from the U.S., and it may crawl military sites to see to it that regulated materials are not being exported (like the pgp fiasco). On the other hand, this is mere speculation, it is equally likely that humans at BXA are putzing around the net, looking at different sites. This latter fact can be established (or we must admit to an incredibly wide reaching bot that is not limited to crypto) because spice.mhv.net has logged connections from corvette to www.mhv.net/~donn/diet.html which is the main page for a health/fitness related hierarchy. It is apparently a popular site for that material and is linked to frequently by other sites. It is possible that a bot crawled around this way, but unlikely since from the evidence on my machine the bot (if it is one) is fairly discriminating about the links it follows. Humans use the corvette proxy. It is hard to tell which links drew corvette's attention from those sites that were hit up. Here is an attempt at a classification of sites that get connections from corvette: * Physics: nsi.net.kiae.su, a nuclear safety institute, keeps a log specifically of U.S. government computers that have connected to them. Corvette made 65 requests to nsi.net.kiae.su. University of Crete Physics Dept. (www.edu.physics.uch.gr) 21 times. * Other Science and Technology: The Bioscan project at genome.cs.unc.edu was hit twice. The BCD (Biological Computing Division) of the Weizmann Institute in Israel was hit 9 times. CSIRO Minerals, www.csiro.au, was hit 1. The Texas Agricultural Extension Service was hit twice. * Political: www.tbs-sct.gc.ca the Canadian Treasury Board was hit once. * Military: The U.S. Army's Signal Corps was hit 13 times. Several universities were hit as well, presumably because of a student pages. Other miscellaneous sites that were hit include a martial arts page, a personal interests page and a porn page. The urls for the pages in question are included below. If this sample of sites is representative of the connections made by corvette, then physics sites make up the bulk of those connections. No verifiable connections were made to crypto related sites other than my own. I do not know why the connections were made to the universities, I figure that it is because of student interests. Given the nature of BXA's mission, and the sort of material that I make available on my homepage on spice I still find it strange that the "Cryptotechnic Enlightenment" page was passed by. This is underscored by the fact that the "Misc." and "Unfinished" links were passed up, even when corvette is obviously looking for crypto stuff (by getting crypto_index.zip). However, there is a general lack of relevent connections made to crypto related sites by corvette on the internet as a whole. If corvette is proxying a bot, I think that the bot may be targeted at individuals and is not a wide-spread intelligence gathering device. I would be interested in hearing if corvette has made connections to crypto oriented sites. If those that run sites with crypto material could post any connections they have had from corvette, I would appreciate it. Michael Graffam (mgraffam(a)mhv.net) - ----------------------------------------------------------------------- URLS relating to corvette.bxa.doc.gov turned up by Altavista: http://chip.mcl.ucsb.edu/lopaka/usage/weeks/hosts/www.mcl.ucsb.edu.13.total… http://www.tbs-sct.gc.ca/tbsstats/tbstats/N1997-06.TXT http://nsi.net.kiae.su/w3perl/Pays/US-Government.html http://www.tbs-sct.gc.ca/tbsstats/tbstats/N1997-03.TXT http://genome.cs.unc.edu/wusage/week59.html http://dapsas.weizmann.ac.il/reports/31Oct1997.hosts.html http://www.minerals.csiro.au/wusage/new/log.ext/log1997/sites0896.html http://www.gordon.army.mil/usage/H1997-01.TXT http://www.amherst.edu/~erreich/visitors.html http://www.ufl.edu/9607-14.html http://data.gc.peachnet.edu/APPS/WWW/USAGE/1996/H1996-07.TXT http://data.gc.peachnet.edu/APPS/WWW/USAGE/1996/H1996-09.TXT http://www.edu.physics.uch.gr/usage/week89.html http://www.edu.physics.uch.gr/usage/week56.html http://www.gordon.army.mil/usage/H1996-09.TXT (2) http://leviathan.tamu.edu:70/0/gnlog/1996/9612/9612.hosts http://lfowler.afternet.com/logfiles/sites0298.html http://www.chelt.ac.uk/usage/ws970622.htm http://www.splosh.co.uk/usage/weeks/hosts/splosh.9.total-hosts.html http://www.ufl.edu/9803-08.html http://www.italcultusa.org/home/_private/mailing.txt http://lfowler.afternet.com/logfiles/sites0198.html Michael J. Graffam (mgraffam(a)mhv.net) http://www.mhv.net/~mgraffam -- Philosophy, Religion, Computers, Crypto, etc I think that we should be men first, and subjects afterward. It is not desirable to cultivate a respect for the law, so much as for the right. Henry David Thoreau "Civil Disobedience" -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQCVAwUBNVS3VQKEiLNUxnAfAQFz2QP+Ow8vwjFYOM/tN4kcyOpxbxWbr4S6bkWv 5zBctIwWk9qWedLxHXMH67JV3AATou1aFUTXL2w4J56frkhgcPIcgjV1j7ME6y/r qNBvysaXzTkIUu/Vj9TJeigbKWTa7YiVgLn97X/RnjfjapD62e3ejhCOurEeDSPr 6u2BFhOGAIk= =fTJr -----END PGP SIGNATURE-----

2 1

Re: U.S. Navy caught hacking into British marine charity Web site
by Spam the President 17 Dec '03

17 Dec '03

On Sat, 9 May 1998, Bill Frantz wrote: > At 4:48 AM -0800 5/9/98, Spam the President wrote: > >http://www.infoworld.com/cgi-bin/displayStory.pl?98058.winavy.htm > > > > U.S. Navy caught hacking > > into British marine > > charity Web site > > > > By Kristi Essick > > InfoWorld Electric > > > > Posted at 3:07 PM PT, May 8, 1998 > > ... > > > > "I think whoever it was within the U.S. Navy > > facility would have better things to do rather than > > try and hack into our computers," said Chris > > Stroud, the organization's director of campaigns, > > in a statement. "If they were seeking reports on > > the Black Sea, we shall be freely publishing these > > in the near future anyway." > > Consider the possibility that someone hacked into the Navy's computer and > then used it as a base to hack the Marine Mammal Charity site. > > ------------------------------------------------------------------------- > Bill Frantz | If hate must be my prison | Periwinkle -- Consulting > (408)356-8506 | lock, then love must be | 16345 Englewood Ave. > frantz(a)netcom.com | the key. - Phil Ochs | Los Gatos, CA 95032, USA It wouldn't make any sense. Why would a hacker use a military site that is actively monitored to hack into a site with less security? And why the requests to get the document originating from the same source? Also, from what I have read, the DoD needs come first in everything, especially Defence Security related issues. No holds barred when they want something. This sounds exactly like the kind of information that they would want and consider essential, and could thus justify themselves to get it by any means available. Of course, if this was a hacker playing tricks to the US military, then I'm sure we can expect the military will publish this serious a security breach, in order to get more money to protect themselves against any Internet terrorist attacks in the future. But I bet there will be no public comments or explanation given. ----- pentagon-gw-e0.nci.net (198.253.200.2) donhq-gw.nci.net (198.253.203.11) donhqns1.hq.navy.mil (164.224.250.80) Trying 164.224.250.80... Connected to 164.224.250.80. Escape character is '^]'. W A R N I N G W A R N I N G W A R N I N G W A R N I N G USE OF THIS OR ANY OTHER DOD INTEREST COMPUTER SYSTEM CONSTITUTES A CONSENT TO MONITORING AT ALL TIMES This is a Department of Navy (DON) interest computer system. All DON interest computer systems and related equipment are intended for the communication, transmission, processing, and storage of official U.S. Government or other authorized information only. All DON interest computer systems are subject to monitoring at all times to ensure proper functioning of equipment and systems including security devices and systems, to prevent unauthorized use and violations of statutes and security regulations, to deter criminal activity, and for other similar purposes. Any user of a DON interest computer system should be aware that any information placed in the system is subject to monitoring and is not subject to any expectation of privacy. If monitoring of this or any other DON interest computer system reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring of this or any other DON interest computer system reveals violations of security regulations or unauthorized use, employees who violate security regulations or make unauthorized use of DON interest computer systems are subject to appropriate disciplinary action. USE OF THIS OR ANY OTHER DOD INTEREST COMPUTER SYSTEM CONSTITUTES A CONSENT TO MONITORING AT ALL TIMES W A R N I N G W A R N I N G W A R N I N G W A R N I N G Username:

2 1