September 2003 - cypherpunks-legacy

When the brownshirts come for your underwear
by Major Variola (ret.) 28 Sep '03

28 Sep '03

http://www.regen.org/raid.htm This is the commune of the guy charged and released for toasting some Hummers. Getting RichardJewell'ed by the FBI. Oh yes, he is "a peace activist who has protested the war in Iraq and actions of the Bush administration" which is surely coincidental. CNN interviewed him 11pm Sat, and he's getting a lawyer. This interview was a few minutes before Declan talked about spam (and mentioned Eudora on CNN!)

1 0

vehicle tracking from inductive signatures
by Major Variola (ret) 28 Sep '03

28 Sep '03

The loops in the road are, after all, analogue: A general vehicle reidentification system using inductive loop signatures to uniquely but anonymously track individual vehicles, has been formulated and tested in recent years at the University of California, Irvine. By using non-obtrusive and anonymous tracking methods, individual vehicles can be identified and correlated over numerous identification stations, and very specific real-time data can be obtained for each tracked vehicle. UCI-ITS-WP-02-12 Anonymous Vehicle Tracking for Real-Time Traffic Surveillance Cheol Oh 1 Stephen G. Ritchie August 2002 Institute of Transportation Studies University of California, Irvine Irvine, CA 92697-3600, U.S.A.

1 0

Terror status: urine-colored
by Major Variola (ret) 28 Sep '03

28 Sep '03

These Passenger Stability Indicators Include : Social Security Number, Length-of-Residence, Income, and Home Ownership. Two Additional Elements If Available Would Likely Be Good Indicators: Namely, Miles Flown Annually and Lifetime. "Homeland Security - Airline Passenger Risk Assessment" Torchconcepts.com ------- Would unplanned urban construction just before the '04 elections help or hurt Bush? Our machines are thrashing on the national-coherency vs. impotency-realization mass-psysim code.

1 0

Re: DC Security Geeks Talk: Analysis of an Electronic Voting System
by Ed Reed 27 Sep '03

27 Sep '03

Grisham might be better - it's the legal wrangling that would tie up people's imagination, more than the technical. >>> "Major Variola (ret)" <mv(a)cdc.gov> 9/25/2003 12:46:13 PM >>> At 02:48 PM 9/24/03 -0400, R. A. Hettinga wrote: ><http://www.cryptonomicon.net/modules.php?name=News&file=print&sid=463> > >Cryptonomicon.Net - > >Talk: Analysis of an Electronic Voting System Someone needs to inject a story about e-voting fraud into the popular imagination. Is Tom Clancy available? Maybe an anonymous, detailed, plausible, (but secretly fictional) blog describing how someone did this in their podunk county... then "leak" this to a news reporter.. Failure to be *able* to assure that this *didn't* happen in that podunk county would make an important point. ---- "On two occasions, I have been asked [by members of Parliament], 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able to rightly apprehend the kind of confusion of ideas that could provoke such a question." -- Charles Babbage --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Re: Critique of CyberInsecurity report
by James A. Donald 27 Sep '03

27 Sep '03

-- On 26 Sep 2003 at 17:30, Sunder wrote: > Ever seen WebX? - it's like PCAnywhere, or VNC or TimbukTu, > only it works over the web. A user just goes to a web page, > and a user at the other end can take over their machine > because IE allows such software to run! > > Ok, at least WebX is a commercial product designed to provide > tech support, and asks if it's ok to allow it, but if it's > technically possible to do it for legitimate reasons, it's > technically feasable to do it for rogue reasons too. IE first checks that the software is digitally signed, and then asks the user do you want to run this software signed by so and so. Then IE allows it to run. You do not just go to the web page. You go to the web page and IE asks if this is OK. Of course there are lots and lots of web pages that say "Hey, click here to view me naked -- just click yes to all the stupid dialogs that come up" --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG EVBFXSY8i4yhJTutdCL23/zyQbi/geQCUHZqoCr7 4J07R9CO6/ynTCaqgsY63x7wtTEVaTRpK5nt5xMio

2 1

Critique of CyberInsecurity report
by futureworlds 26 Sep '03

26 Sep '03

The CyberInsecurity essay is available at http://www.ccianet.org/papers/cyberinsecurity.pdf. A few comments: Overall, this is a terrible analysis with a misguided solution which, if adopted, would only make things worse. It is shocking to see the well known figures who have allowed their names to be attached to this document. Apparently hatred of Microsoft runs so deep that people are unable to think critically when presented with an analysis that attacks the company. We saw the same thing with the absurd lies and exaggerations about Palladium last year. > The threats to international security posed by Windows are significant, > and must be addressed quickly. We discuss here in turn the problem in > principle, Microsoft and its actions in relation to those principles, and > the social and economic implications for risk management and policy. The > points to be made are enumerated at the outset of each section, and > then discussed. Let's look at these three portions. The "problem in principle", according to the report, is the existence of a monoculture, which should be addressed by diversification. There are nonsense figures in here that claim to quantify the "power" of the net, using absurd, handwavey formulations like Metcalfe's Law or Reed's Law. (Reed's so-called Law is a joke, predicting that the Internet will be 228 quadrillion times more "powerful" in 10 years if the number of systems increases 50% per year!) This is not logic, this is not reason, it is just rhetoric. But the fundamental problem with the analysis here, which is what makes the report's recommendation so misguided, is that claim that diversification will somehow solve the problem. In fact, diversification will make it worse, as a moment's thought should make clear. Let's suppose that the government stepped in, and the kind, wise government bureaucrats we all know and love so well decided to aid disadvantaged operating systems. This affirmative action program is so effective that after many years, Microsoft has only a third of the market; Macs have another third; and Linux has most of the remaining third. Wow, the problem is solved, right? Wrong. With the number of systems on the net growing rapidly, any realistic extrapolation leaves the number of Windows systems as being even larger than today. Hence we face at least as much exposure as at present, which the evidence has shown is more than enough to cause tremendous economic damage. And in fact, it is worse, because any flaws in the Mac or Linux OSs will now be just as dangerous as for Windows! What we will face is a situation where the *weakest* of the widely used OS's will determine the risk factor for the system as a whole. This is not the kind of redundancy which reduces risk. There is no effective way that the presence of other architectures is going to prevent a virus or worm from being able to spread just as rapidly as today. That error is the most fundamental in the report, but let's turn to their analysis of Microsoft's dominance, where again they have utterly missed the obvious truth. The report claims that the reason for Microsoft's dominance in OS is due to what it calls application lock-in, which is a nasty way of saying that people prefer Windows because they want to use applications that are only available on that architecture. This part is obviously true. But the report tries to link this to the claim that this is all due to Microsoft's strategy to tightly integrate applications and the operating system, which is absurd. In the first place, many of the most popular applications which drive people to choose Windows aren't even from Microsoft. Games, business software, web utilities, there are thousands of popular programs which are only available on the Windows architecture. These programs aren't built into the OS, but instead the companies making this software have chosen Windows because it is popular, has good development tools, and in the early days was easier to write for (remember that up until a few years ago, the Mac lacked preemptive multitasking, and Linux wasn't even a blip on the radar). In the second place, Microsoft does in fact make some of its most popular applications available on the Mac. Office and its predecessors, and IE have been available for many years on that platform. These apps are not locked to the OS as the report claims. And in the third place, the real reason why Microsoft preferentially supports Windows is not due to technical integration with the OS, but for the obvious economic reason that the Windows OS is made by the same company as Windows apps, so it makes sense for the latter to support the former. This fact is so utterly obvious that it is astonishing that the report manages to miss it. > The natural strategy for a monopoly is user-level lock-in and Microsoft > has adopted this strategy. Even if convenience and automaticity for the > low-skill/no-skill user were formally evaluated to be a praiseworthy > social benefit, there is no denying the latent costs of that social > benefit: lock-in, complexity, and inherent risk. Here the report manages to touch upon a particularly important point, but as usual to miss its significance. The point is that Microsoft's security vulnerabilities are due to the fact that it is making its software easy to use. But that is one of the main reasons it is so successful! Believe it or not, people like software that is usable and has features they need. Doing so is difficult and makes software more complex. By adopting this strategy, Microsoft has inevitably acquired security vulnerabilities over the years. What the report misses, then, is that any other OS or company which adopts the same strategy is going to face the same problem. But companies are going to be forced to make their software easier to use and more complex in order to compete with Microsoft, even if the report's recommendations were adopted. This is going to add to the problem noted above, that the other OS's are going to have security vulnerabilities as well, once they are widely used. What the authors appear to really want is to somehow change software development methodology so that security takes precedence over features. As a security professional who has worked for many years on consumer products, I am well aware of the tension that exists within corporations between these two competing goals. It is perhaps understandable that others in our field are trying to win this argument by government fiat. The authors are in effect saying that they know better than the end users what is important; that if customers prefer that their word processors are functional, their wishes would be overridden in order to make the programs more secure. Even if we accept this argument (the morality of which is highly questionable), forcing Microsoft to port Office to Linux isn't going to do a single thing to accomplish it! As noted above, the only effect is going to be more pressure on the newly enfranchised OS's to become more like Microsoft in order to compete, that is, to add features and complexity. Ultimately, those are the preferences of the people buying the computers, and no amount of pontificating by the authors of this report is going to change those economic incentives. Turning to the third section of the report, the authors contradict themselves by claiming that Microsoft will not change its habits, while at the end of the second section they just listed several important changes. Microsoft's trustworthy computing initiative, its introduction of delays in product release in order to address security goals, and its work towards a secure computing base are all changes that indicate that Microsoft is taking a much more serious attitude towards security. But rather than give the company a chance to see what it can do in terms of making its products more secure, the report proposes to force Microsoft to reorient its development efforts towards making Mac and Linux versions of all its software, as if that will solve anything: > Microsoft should be required to support a long list of applications > (Microsoft Office, Internet Explorer, plus their server applications and > development tools) on a long list of platforms. Microsoft should either > be forbidden to release Office for any one platform, like Windows, > until it releases Linux and Mac OS X versions of the same tools that > are widely considered to have feature parity, compatibility, and so forth. The arrogance of this proposal is beyond belief. One of the most successful companies in the world, one which even the report admits has specialized in making software easy to use and meeting the needs and requirements of end users, is expected to reorient its development efforts and port its massive software base to a "long list" of platforms. No consideration is given to the costs of this government-imposed mandate. No concern is expressed about the impact on end users who have come to appreciate Microsoft's increasingly functional applications. Ironically, no one even seems to realize that resources spent doing these ports may well detract from Microsoft's current efforts to refocus on security improvements! Forcing the company to change direction like this is likely to weaken security, not improve it. The lack of any strong evidence that these drastic measures will improve the security of the net as a whole demonstrates that this is an ideological report rather than a technical one. Hand-waving about diversification does not answer the point. Realistically, even if the net does become more diversified (which will probably happen, gradually and naturally, without Draconian government regulation), we are still going to have a relatively limited number of architectures that are popular. That's just the way markets work; there is only a limited amount of public attention to go around, and in most markets there are only a few companies which claim the majority of the market share. The result is that we will have a system where, as pointed out above, not one but several architectures are each widespread enough to bring the net to its knees when an exploit is discovered. This network will only be as strong as its weakest link. Diversity, in this context, is a risk factor, not a risk mediator. In summary, this report is misguided and mistaken on so many levels that it is astonishing that such well respected figures were willing to put their names to it. The analysis is flawed or missing. The recommendations are harsh, extreme and premature. And ultimately their proposals will only serve to make the problem worse, not better.

3 2

Dan Geer Fired (was re: Technology Firm With Ties to Microsoft Fires Executive Over Criticism)
by R. A. Hettinga 26 Sep '03

26 Sep '03

<http://info.mgnetwork.com/printthispage.cgi?url=http%3A//ap.tbo.com/ap/brea…> Sep 25, 2003 Technology Firm With Ties to Microsoft Fires Executive Over Criticism By Ted Bridis The Associated Press WASHINGTON (AP) - The chief technology officer for a technology firm that works closely with Microsoft Corp. lost his job after he helped write a study critical of the insecurity of Microsoft software. Daniel E. Geer Jr., an expert with nearly three decades studying technology and computer security, learned Thursday he was no longer employed by AtStake Inc. of Cambridge, Mass. AtStake declined to say whether Geer resigned or was fired. Spokeswoman Lona Therrien said Microsoft did not call for Geer's dismissal, which AtStake said was effective two days ago. Microsoft also said it was not involved in the decision. But critics said Geer's firing was reflective of Microsoft's far-reaching ability in Washington and across the technology industry to silence experts who complain about weaknesses in its software or its aggressive business practices. The Justice Department struggled years ago to find technology executives willing to testify against Microsoft in its antitrust trial. Geer could not be reached immediately for comment, but one person familiar with Geer's situation said he was fired in a call Thursday morning from AtStake executives. AtStake has worked closely with Microsoft in the past, examining some of its software blueprints for security problems and providing consulting services. AtStake's announcement came one day after Geer and six other experts published a report complaining that the U.S. government relies too heavily on software from Microsoft. It argued that the widespread dominance of Windows has created an unhealthy "monoculture" inadequately resistant to viruses and attacks by hackers. Geer was identified Wednesday in a conference call with journalists as AtStake's technology officer and the lead author of the report, which was funded by the Washington-based Computer and Communications Industry Association, a trade group whose members include some of Microsoft's biggest corporate rivals. "The values and opinions of the report are not in line with AtStake's views," the company said in a statement. It said Geer's participation working on the report was "not sanctioned." "Security is much more complicated than focusing on this one issue," said Chris Wysopal, AtStake's director of research and development. "We think the way the (CCIA) paper is positioned ... is just not the answer." Wysopal said experts within AtStake debate about security issues internally but that Geer represented his views as the company's consensus. "We value diversity of opinions here," Wysopal said. Bruce Schneier, the chief technology officer for Counterpane Systems Inc., worked with Geer on the report. He said security experts contacted to help work on the report critical of Microsoft indicated their support but couldn't participate publicly. "There is a huge chilling effect based on Microsoft's monopoly position," Schneier said. "It's unfortunate that AtStake put its private agenda ahead of intellectual integrity." The CCIA trade group also ran into trouble Thursday when it sought to send a paid announcement about its critical Microsoft report to 140,000 subscribers of popular trade magazines for chief security officers and chief information officers. The publisher for CIO and CSO magazines, CXO Media Inc., offers such announcements "to target a specific market segment of our audience by designing a list of prospects for direct mail and e-mail purposes." But in this case, the subject was too touchy. "We find it is too sensitive of material to send out. I'm sorry to be the bearer of bad news, but I have to deny your request," according to an e-mail from the publisher obtained by The Associated Press. "We need to try to provide some balance on these issues, and this seemed a little one-sided," CXO spokeswoman Karen Fogerty said. --- On the Net: AtStake Inc.: www.atstake.com Microsoft Corp. www.microsoft.com CXO Media Inc.: www.cio.com CCIA: www.ccianet.org AP-ES-09-25-03 1629EDT This story can be found at: http://ap.tbo.com/ap/breaking/MGASNQR81LD.html -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

RE: Critique of CyberInsecurity report
by Vincent Penquerc'h 26 Sep '03

26 Sep '03

> Wow, the problem is solved, right? > > Wrong. With the number of systems on the net growing rapidly, any > realistic extrapolation leaves the number of Windows systems as being > even larger than today. Hence we face at least as much exposure as > at present, which the evidence has shown is more than enough to cause > tremendous economic damage. You miss out on the fact that, if Windows has, say, 90% of the machines (disregarding differences between desktop/server/whatever), the damage would, with your metric, be three times as large as the cost you point at, which would affect a third of the machines (with numbers higher than today, but still less that what they would be with 90% of machines running MS). > And in fact, it is worse, because any flaws in the Mac or Linux OSs > will now be just as dangerous as for Windows! What we will face is a > situation where the *weakest* of the widely used OS's will determine > the risk factor for the system as a whole. Yes, you are right: when you don't put all your eggs in the same basket, you have *more* risk to get crushed eggs. But, in return, you have less risk of losing *all* your eggs. The point is to contain worst case cost, at the expense of having more likely minimum cost. > chosen Windows because it is popular, has good development tools, and > in the early days was easier to write for (remember that up until a few > years ago, the Mac lacked preemptive multitasking, and Linux wasn't even > a blip on the radar). Windows 2000 was only a few years ago too. Windows NT 3 and 4 were not desktopo OSes, used only on servers. And I worked in a company that had the misfortune of running an NT 3 server. Preemptive multitasking does not imply stability, as this experience showed, though I won't claim our experience was typical. There was BeOS too, which could have been widely available save for MS having the computer makers' ear (firmly grasped in an iron fist). But you still have a fair point on this point, and I agree at varying degrees with the rest of your points, except where you come back to: > The result is that we will have a system where, as pointed out above, > not one but several architectures are each widespread enough to bring > the net to its knees when an exploit is discovered. This network will > only be as strong as its weakest link. Diversity, in this context, is > a risk factor, not a risk mediator. For serial systems, not parallel ones. Encryption is a serial one. Redundancy using different systems is not: you need to destroy all branches to bring the system down (though I do not deny that you can bring the quality of service down by bringing a node down, depending on the degree of redundancy). Of course, the above holds for a more or less homogeneous distribution of the different (here) OSes. Otherwise, you have a connected graph of monocultures, and the first argument applies. -- Vincent Penquerc'h

1 0

unsubscripe list
by kluss＠ziplip.com 26 Sep '03

26 Sep '03

1 0

No Subject
by kluss＠ziplip.com 26 Sep '03

26 Sep '03

unsubscribe list

1 0