October 2004 - cypherpunks-legacy

[ISN] Worldwide Phishing Attacks May Stem from Few Sources
by InfoSec News 20 Oct '04

20 Oct '04

http://www.eweek.com/article2/0,1759,1679953,00.asp By Dennis Fisher October 19, 2004 Research from an e-mail security provider suggests that a handful of people are responsible for the vast majority of the phishing attacks on the Internet and the perpetrators are using a rotating series of zombie networks to launch them. Researchers at CipherTrust Inc. analyzed more than four million e-mails collected from the company's customers during the first two weeks of October and found that nearly a third of all of the zombie machines sending the phishing messages are based in the United States. That's twice as many as the 16 percent that are found in South Korea. However, these findings do not mean that these attacks are originating from inside these countries. The global nature of the Internet allows attackers anywhere in the world to compromise machines in any location. In fact, many experts believe that the majority of phishers are in some way connected to organized crime groups in Russia or Eastern Europe and that most such attacks begin there. The most surprising conclusion of the research is that the attackers sending out the phishing messages are using zombie networks of only about 1,000 PCs. "That's a pretty small bot network for the volume of stuff that these guys are doing," said Dmitri Alperovitch, the research engineer at Atlanta-based CipherTrust Inc. who conducted the study. "But the trick is that they rotate to a different set of compromised machines each day. They don't keep going to the same ones each time." Crackers for years have been accumulating large networks of machines compromised with small programs that give them the ability to control the PCs remotely. They routinely sell or trade access to the networks to others in the cracker underground and the PCs typically are used either for launching DDoS (distributed denial of service attacks). But as authorities began cracking down on spammers in recent years, the spammers have begun relying on these networks to send out their messages, too. Now, phishers have gotten into the game. Alperovitch said that there are fewer than five operators in control of the zombie networks that he identified in his research. And, even though they're generating thousands of fraudulent e-mails every day, their output was still a tiny fraction.less than one percent--of the four million messages CipherTrust examined. Phishers seem to be concentrating their efforts on a few high-profile targets, as well. In the sample CipherTrust looked at, 54 percent of the phishing messages used CitiGroup's Citibank name to entice recipients. Another 13 percent use Citigroup Global Markets Inc.'s Smith Barney's brand and eBay Inc. is the victim in about four percent of the scams. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] 2-Fingerprint Border ID System Called Inadequate
by InfoSec News 20 Oct '04

20 Oct '04

http://www.washingtonpost.com/wp-dyn/articles/A43276-2004Oct18.html By Robert O'Harrow and Jr. Scott Higham Washington Post Staff Writers October 19, 2004 Terrorists who alter their fingerprints have about an even chance of slipping past U.S. border watch-list checks because the government is using a two-fingerprint system instead of one that relies on all 10 prints, a lawmaker said in a letter he made public yesterday to Homeland Security Secretary Tom Ridge. Rep. Jim Turner (D-Tex.) wrote that a study by researchers at Stanford University concluded the two-finger system "is no more than 53 percent effective in matching fingerprints with poor image quality against the government's biometric terrorist watch-list." Turner said the system falls far short of keeping the country secure. "It's going to be a coin toss as to whether we can identify terrorists," Turner, the ranking member of the House Select Committee on Homeland Security, said in an interview yesterday. "It's a 50-50 chance, and that's not good enough." Turner's Oct. 15 letter comes as government officials supervising the burgeoning border security system, known as US-VISIT, have been touting their use of fingerprints for identifying people crossing the border and checking them against watch lists of suspected terrorists. The US-VISIT program aims to create a "virtual border" using computer networks, databases, fingerprints and other biometric identifiers. The program requires foreign visitors to register their names before traveling to the United States and have their fingerprints checked when they arrive and depart. Officials estimate the system could cost up to $10 billion and take a decade to build. The border security program is relying on technology first developed for a program at the former Immigration and Naturalization Service called IDENT. Government officials have known for years that IDENT did not work well with the identification system used by the Justice Department, a 10-fingerprint system called the Integrated Automated Fingerprint Identification System. That system is known for producing good results, even with poor-quality fingerprint images, Turner's letter said. But homeland security officials have told Congress they decided to use the IDENT system for the first phase of US-VISIT as a way to quickly improve security at the borders, and move to a 10-fingerprint system later. "It was a logistical issue we had to deal with," said Robert A. Mocny, deputy director of US-VISIT. "It will get better. . . . It's a matter of what we can do right now." Turner's letter said the Department of Homeland Security ignored numerous warnings from the "government's top biometric scientists" that the "two-fingerprint system could not accurately perform watch list searches and the ten-fingerprint system was far preferable." The letter quotes Stanford researcher Lawrence M. Wein, who said his study found that at best, with a software fix, the two-finger system would properly identify only about three of four people. Two weeks ago, Wein told the Homeland Security Committee that the "implications of our findings are disturbing." Turner accused homeland security officials of failing to be "more forthcoming" about the limitations of their approach. Turner asked Ridge to direct homeland security officials to "preserve all documents and electronic communications" relating to their decision on fingerprints. "I understand your desire to deploy biometric screening at our borders as quickly as possible," Turner said in his letter. "But more than three years after the 9/11 attacks, we have invested more than $700 million in an entry-exit system that cannot reliably do what the Department so often said it would: Use a biometric watch-list to keep known terrorists out of the country." A spokesman for the Republican-controlled Homeland Security Committee, Ken Johnson, said the release of Turner's letter was driven by election-year politics. Johnson acknowledged that there are "some concerns" with the current system, but he said US-VISIT continues to evolve. "In a perfect world, where money is not an issue, and people wouldn't mind spending countless hours or days at the border, the 10-fingerprint system would be preferable. But that's not reality," Johnson said. "They're playing politics with some very sensitive issues." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] 2-Fingerprint Border ID System Called Inadequate
by InfoSec News 20 Oct '04

20 Oct '04

http://www.washingtonpost.com/wp-dyn/articles/A43276-2004Oct18.html By Robert O'Harrow and Jr. Scott Higham Washington Post Staff Writers October 19, 2004 Terrorists who alter their fingerprints have about an even chance of slipping past U.S. border watch-list checks because the government is using a two-fingerprint system instead of one that relies on all 10 prints, a lawmaker said in a letter he made public yesterday to Homeland Security Secretary Tom Ridge. Rep. Jim Turner (D-Tex.) wrote that a study by researchers at Stanford University concluded the two-finger system "is no more than 53 percent effective in matching fingerprints with poor image quality against the government's biometric terrorist watch-list." Turner said the system falls far short of keeping the country secure. "It's going to be a coin toss as to whether we can identify terrorists," Turner, the ranking member of the House Select Committee on Homeland Security, said in an interview yesterday. "It's a 50-50 chance, and that's not good enough." Turner's Oct. 15 letter comes as government officials supervising the burgeoning border security system, known as US-VISIT, have been touting their use of fingerprints for identifying people crossing the border and checking them against watch lists of suspected terrorists. The US-VISIT program aims to create a "virtual border" using computer networks, databases, fingerprints and other biometric identifiers. The program requires foreign visitors to register their names before traveling to the United States and have their fingerprints checked when they arrive and depart. Officials estimate the system could cost up to $10 billion and take a decade to build. The border security program is relying on technology first developed for a program at the former Immigration and Naturalization Service called IDENT. Government officials have known for years that IDENT did not work well with the identification system used by the Justice Department, a 10-fingerprint system called the Integrated Automated Fingerprint Identification System. That system is known for producing good results, even with poor-quality fingerprint images, Turner's letter said. But homeland security officials have told Congress they decided to use the IDENT system for the first phase of US-VISIT as a way to quickly improve security at the borders, and move to a 10-fingerprint system later. "It was a logistical issue we had to deal with," said Robert A. Mocny, deputy director of US-VISIT. "It will get better. . . . It's a matter of what we can do right now." Turner's letter said the Department of Homeland Security ignored numerous warnings from the "government's top biometric scientists" that the "two-fingerprint system could not accurately perform watch list searches and the ten-fingerprint system was far preferable." The letter quotes Stanford researcher Lawrence M. Wein, who said his study found that at best, with a software fix, the two-finger system would properly identify only about three of four people. Two weeks ago, Wein told the Homeland Security Committee that the "implications of our findings are disturbing." Turner accused homeland security officials of failing to be "more forthcoming" about the limitations of their approach. Turner asked Ridge to direct homeland security officials to "preserve all documents and electronic communications" relating to their decision on fingerprints. "I understand your desire to deploy biometric screening at our borders as quickly as possible," Turner said in his letter. "But more than three years after the 9/11 attacks, we have invested more than $700 million in an entry-exit system that cannot reliably do what the Department so often said it would: Use a biometric watch-list to keep known terrorists out of the country." A spokesman for the Republican-controlled Homeland Security Committee, Ken Johnson, said the release of Turner's letter was driven by election-year politics. Johnson acknowledged that there are "some concerns" with the current system, but he said US-VISIT continues to evolve. "In a perfect world, where money is not an issue, and people wouldn't mind spending countless hours or days at the border, the 10-fingerprint system would be preferable. But that's not reality," Johnson said. "They're playing politics with some very sensitive issues." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] NZ jails Aussie bank hacker
by InfoSec News 20 Oct '04

20 Oct '04

http://australianit.news.com.au/articles/0,7204,11087415%5E15331%5E%5Enbv%5… Amanda Hodge OCTOBER 16, 2004 AN Australian IT whiz who stole $2.15 million after hacking into the New Zealand Health Ministry's bank account and then offered to brief the department on the weaknesses in its computer security system was yesterday jailed for three years. With university degrees in science and mathematics, an MBA and years of international computer experience, John Denison, 49, cruised into a senior job with the NZ Health Ministry in March. But in six months of service, in which he headed a national meningococcal B vaccination program, Denison tried unsuccessfully five times to crack the ministry's computer banking system. On his final attempt, in late September, he found fleeting success, hacking into the system and redirecting $2.15 million bound for doctors and medical laboratories to his own bank account, which he set up with a false passport and driver's licence in the name of Alan Bennett. Denison tried to use almost $800,000 as a down payment on a luxury apartment overlooking Sydney's Hyde Park before he was caught. He had been planning to return to Sydney to be near his critically ill sister but confessed to the thefts and passport fraud shortly after several laboratories rang the ministry to complain about the missing money. All the money has since been recovered. Wellington District Court judge Robert Kerr permanently suppressed details of how Denison hacked into the system. The crime was a gross abuse of trust that was partly motivated by a desire to maintain a certain quality of life, Judge Kerr said. Denison's lawyer, Greg King, argued the offence had arisen out of "something of a mid-life crisis" because his client's annual income had plunged from $200,000 to $103,000 when he took the new job. But Denison had also been under extreme financial pressure, supporting an acutely deaf and depressed brother, a sister who was still in hospital after suffering a brain aneurism in July, and also paying child maintenance. Yesterday, Denison's NSW-based former wife said she and her three children were devastated by the outcome but were trying to keep the news from Denison's brother and sister, who were too ill to withstand the trauma. Mr King said the Health Ministry had acted arrogantly by refusing an offer by a penitent Denison to talk them through the security gaps in its system. Crown prosecutor Cherie Clarke said the ministry did not want or need Denison's help. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] NZ jails Aussie bank hacker
by InfoSec News 20 Oct '04

20 Oct '04

http://australianit.news.com.au/articles/0,7204,11087415%5E15331%5E%5Enbv%5… Amanda Hodge OCTOBER 16, 2004 AN Australian IT whiz who stole $2.15 million after hacking into the New Zealand Health Ministry's bank account and then offered to brief the department on the weaknesses in its computer security system was yesterday jailed for three years. With university degrees in science and mathematics, an MBA and years of international computer experience, John Denison, 49, cruised into a senior job with the NZ Health Ministry in March. But in six months of service, in which he headed a national meningococcal B vaccination program, Denison tried unsuccessfully five times to crack the ministry's computer banking system. On his final attempt, in late September, he found fleeting success, hacking into the system and redirecting $2.15 million bound for doctors and medical laboratories to his own bank account, which he set up with a false passport and driver's licence in the name of Alan Bennett. Denison tried to use almost $800,000 as a down payment on a luxury apartment overlooking Sydney's Hyde Park before he was caught. He had been planning to return to Sydney to be near his critically ill sister but confessed to the thefts and passport fraud shortly after several laboratories rang the ministry to complain about the missing money. All the money has since been recovered. Wellington District Court judge Robert Kerr permanently suppressed details of how Denison hacked into the system. The crime was a gross abuse of trust that was partly motivated by a desire to maintain a certain quality of life, Judge Kerr said. Denison's lawyer, Greg King, argued the offence had arisen out of "something of a mid-life crisis" because his client's annual income had plunged from $200,000 to $103,000 when he took the new job. But Denison had also been under extreme financial pressure, supporting an acutely deaf and depressed brother, a sister who was still in hospital after suffering a brain aneurism in July, and also paying child maintenance. Yesterday, Denison's NSW-based former wife said she and her three children were devastated by the outcome but were trying to keep the news from Denison's brother and sister, who were too ill to withstand the trauma. Mr King said the Health Ministry had acted arrogantly by refusing an offer by a penitent Denison to talk them through the security gaps in its system. Crown prosecutor Cherie Clarke said the ministry did not want or need Denison's help. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Financial identity is *dangerous*? (was re: Fake companies, real money
by R.A. Hettinga 19 Oct '04

19 Oct '04

--- begin forwarded text

1 1

Crypto blogs?
by R.A. Hettinga 19 Oct '04

19 Oct '04

--- begin forwarded text

1 0

Re: Financial identity is *dangerous*? (was re: Fake companies, real money)
by R.A. Hettinga 19 Oct '04

19 Oct '04

--- begin forwarded text

1 0

CFP 2005 PKI R&D Workshop - Deadline soon
by R.A. Hettinga 19 Oct '04

19 Oct '04

--- begin forwarded text

1 0

[Humor] [TSCM-L] secret agent man!!! (fwd)
by J.A. Terranson 19 Oct '04

19 Oct '04

---------- Forwarded message ---------- Date: Mon, 18 Oct 2004 16:02:53 -0700 From: A.Lizard <alizard(a)ecis.com> Reply-To: TSCM-L(a)yahoogroups.com To: TSCM-L(a)yahoogroups.com Subject: [TSCM-L] secret agent man!!! >Sad state of spying >Intelligence vets are still musing over Michael Kostiw, whose reported >shoplifting forced his withdrawal this month as the CIA's prospective >executive director. But what dismays the spooks most isn't the ethics or >the propriety of the case--it's that Kostiw had served as a case officer >for 10 years and still couldn't manage to shoplift a package of bacon >without getting caught in a Northern Virginia market. Says one old spy: >"It's a perfect metaphor for the sorry state of the CIA" http://www.usnews.com/usnews/issue/041025/whispers/25whisplead.htm While I don't think this the place for political debate, I think the state of US intelligence services is something of interest to everyone on the list. I only hope this guy hasn't been training people. A.Lizard -- member The Internet Society (ISOC), The HTML Writers Guild. "Feudal societies go broke. These top-heavy crony capitalists of the Enron ilk are nowhere near so good at business as they think they are." Bruce Sterling Personal Website http://www.ecis.com/~alizard business Website http://reptilelabs.com backup address (if ALL else fails) alizard(a)gmail.com PGP 8.0 key available by request or keyserver. Download PGP from: http://www.pgpi.org for e-mail privacy. Disaster prep info: http://www.ecis.com/~alizard/y2k.html ***Looking for INTELLIGENT new technology public policy alternatives?*** http://www.ecis.com/~alizard/technology.html ------------------------ Yahoo! Groups Sponsor --------------------~--> $9.95 domain names from Yahoo!. Register anything. http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/UBhwlB/TM --------------------------------------------------------------------~-> ======================================================== TSCM-L Technical Security Mailing List "In a multitude of counselors there is strength" To subscribe to the TSCM-L mailing list visit: http://www.yahoogroups.com/community/TSCM-L It is by caffeine alone I set my mind in motion. It is by the juice of Star Bucks that thoughts acquire speed, the hands acquire shaking, the shaking is a warning. It is by caffeine alone I set my mind in motion. =================================================== TSKS Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/TSCM-L/ <*> To unsubscribe from this group, send an email to: TSCM-L-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/

1 0