October 2004 - cypherpunks-legacy

Re: Printers betray document secrets
by Dave Howe 29 Oct '04

29 Oct '04

Ian Grigg wrote: > It's actually quite an amusing problem. When put > in those terms, it might be cheaper and more secure > to go find some druggie down back of central station, > and pay them a tenner to write out the ransom demand. > Or buy a newspaper and start cutting and pasting the > letters... or slightly more professional - lettraset rub-down lettering. available in a wide range of fonts, requires no special equipment to use, and (although not of any value in this application) sufficiently acid resistant to be used on etch boards.

1 0

[ISN] Secret Service busts online organized crime ring
by R.A. Hettinga 29 Oct '04

29 Oct '04

--- begin forwarded text

1 0

[ISN] Secret Service busts online organized crime ring
by InfoSec News 29 Oct '04

29 Oct '04

http://www.computerworld.com/securitytopics/security/story/0,10801,97017,00… By Dan Verton OCTOBER 28, 2004 COMPUTERWORLD In what it called an "Information Age undercover investigation," the U.S. Secret Service today announced that it has arrested 28 people from eight U.S. states and six countries allegedly involved in a global organized cybercrime ring. Charges filed against the suspects include identity theft, computer fraud, credit card fraud and conspiracy. The investigation, code-named Operation Firewall, resulted in what the Secret Service described as a significant disruption of organized criminal activity online that was targeting the financial infrastructure of the U.S. The suspects are alleged to have collectively trafficked in at least 1.7 million stolen credit card numbers. Financial institutions have estimated their losses associated with the suspects targeted by the investigation to be more than $4.3 million. "Led by the Secret Service Newark Field Office, investigators from nearly 30 domestic and foreign Secret Service offices and their global law enforcement counterparts have prevented potentially hundreds of millions of dollars in loss to the financial and hi-tech communities," Secret Service Director W. Ralph Basham said in a statement. "These suspects targeted the personal and financial information of ordinary citizens, as well as the confidential and proprietary information of companies engaged in e-commerce." Operation Firewall began in July 2003 and quickly evolved into a transnational investigation of global credit card fraud and online identity theft. The underground criminal groups have been identified as Shadowcrew, Carderplanet and Darkprofits. The organizations operated Web sites used to traffic counterfeit credit cards and false identification information and documents. The groups allegedly used the sites to share information on how to commit fraud and sold the stolen information and the tools needed to commit such crimes. International law enforcement organizations that took part in the investigation and arrests included the U.K.'s National Hi-Tech Crimes Unit, the Vancouver Police Department's Financial Crimes Section, the Royal Canadian Mounted Police and Europol. Officials in Bulgaria, Belarus, Poland, Sweden, the Netherlands and Ukraine also were involved. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Secret Service busts online organized crime ring
by InfoSec News 29 Oct '04

29 Oct '04

http://www.computerworld.com/securitytopics/security/story/0,10801,97017,00… By Dan Verton OCTOBER 28, 2004 COMPUTERWORLD In what it called an "Information Age undercover investigation," the U.S. Secret Service today announced that it has arrested 28 people from eight U.S. states and six countries allegedly involved in a global organized cybercrime ring. Charges filed against the suspects include identity theft, computer fraud, credit card fraud and conspiracy. The investigation, code-named Operation Firewall, resulted in what the Secret Service described as a significant disruption of organized criminal activity online that was targeting the financial infrastructure of the U.S. The suspects are alleged to have collectively trafficked in at least 1.7 million stolen credit card numbers. Financial institutions have estimated their losses associated with the suspects targeted by the investigation to be more than $4.3 million. "Led by the Secret Service Newark Field Office, investigators from nearly 30 domestic and foreign Secret Service offices and their global law enforcement counterparts have prevented potentially hundreds of millions of dollars in loss to the financial and hi-tech communities," Secret Service Director W. Ralph Basham said in a statement. "These suspects targeted the personal and financial information of ordinary citizens, as well as the confidential and proprietary information of companies engaged in e-commerce." Operation Firewall began in July 2003 and quickly evolved into a transnational investigation of global credit card fraud and online identity theft. The underground criminal groups have been identified as Shadowcrew, Carderplanet and Darkprofits. The organizations operated Web sites used to traffic counterfeit credit cards and false identification information and documents. The groups allegedly used the sites to share information on how to commit fraud and sold the stolen information and the tools needed to commit such crimes. International law enforcement organizations that took part in the investigation and arrests included the U.K.'s National Hi-Tech Crimes Unit, the Vancouver Police Department's Financial Crimes Section, the Royal Canadian Mounted Police and Europol. Officials in Bulgaria, Belarus, Poland, Sweden, the Netherlands and Ukraine also were involved. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

the simian unelected is blocking the world
by Eugen Leitl 28 Oct '04

28 Oct '04

Access to http://www.georgewbush.com/ is blocked but from US IP address space. Access Denied You don't have permission to access "http://www.georgewbush.com/" on this server. http://www.anonymization.net/http://www.georgewbush.com works with no problems, though. Ha Ha Curious George. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

6 15

Palladiated Handheld Security Spec
by R.A. Hettinga 28 Oct '04

28 Oct '04

<http://www.eweek.com/print_article/0,1761,a=138221,00.asp> EWeek 'Palladium' Echoes in New Handheld Security Spec October 27, 2004 By Mark Hachman Intel, IBM and NTT DoCoMo have released a specification to create a "trusted mobile platform," which appears to take the foundation of Microsoft's own trust initiative, "Palladium," into the mobile space. The three companies placed the Trusted Mobile Platform specification on the Internet for public review. An executive at Santa Clara, Calif.-based Intel said the company hopes to have TMP products on the market by 2005, although the timing will be heavily dependent on OEM participation. ADVERTISEMENT The problem is that, as of now, the TMP group does not include a participating handset OEM, an operating-system manufacturer, a radio-component manufacturer, an application provider or a manufacturer of the trusted platform module (TPM) components that will be used to secure the platform. The lack of these elements led one analyst to state that the triumvirate will need many more players to achieve the critical mass it will need to move forward. But things move quickly in the mobile space, other analysts said, and even an aggressive 2005 launch date might not be out of reach. The goal is to provide a means of "trust" inside a mobile platform, similar to the "Palladium" initiative Microsoft Corp. began floating in 2002 and later referred to as the Next Generation Secure Computing Base. NGSCB is supposed to be a feature of Longhorn, Microsoft's next-generation OS. In May, Microsoft said it would tweak the Palladium architecture to make it simpler for developers to produce compatible applications. Like Palladium, the TMP initiative is designed to secure mobile commerce and protect the system from viruses and/or worms designed to modify the internal code. Intel's contributions are as a chip provider, while DoCoMo contributed the "key usage scenarios" that guided the research into creating the specification, said Jeff Krisa, director of marketing for Intel's cellular handheld group. Next Page: A lack of support from key vendors. Intel has already placed some elements of the TMP within its "Bulverde" wireless applications processor, known as the PXA27X family, Krisa said. "The level of digital rights management will be implemented on the software level within the middleware, and will procedurally determine what you can pass forward and save on the handset as well," Krisa said, adding that it will be managed by IBM's WebSphere team. IBM contributed software "expertise," June Namioka, a spokeswoman for IBM's Asia-Pacific headquarters in Tokyo, said in an interview. Intel's Krisa said work focused on some of the higher-end software protocols used by the technology. One analyst called IBM's involvement significant. "Enterprise wireless apps are more of a concern for the average IT manager than for the average consumer," said Julie Ask, a wireless analyst with Jupitermedia Corp.'s JupiterResearch division. "The risk isn't so much in bringing down my phone, it's hacking into my system or making sure the workers on the factory floor can't talk to one another, which could be disastrous." However, the initiative currently lacks the support of a number of other key vendors. For his part, Krisa said the 2005 launch date is "highly dependent on other members, middleware ecosystem and OS vendors." A representative from Symbian, a U.K.-based provider of embedded OSes, did not return a call for comment. Although both the hardware and software specifications were released Wednesday, the software document indicates that it was authored June 23. Analyst reaction was mixed. "Without having details, I see this '05 thing as questionable," said Neil Strother, senior analyst with In-Stat/MDR in Phoenix. "Even if they move quickly, I'm skeptical." If you want to build trust in the trust model, "you have to get the banking guys on board," he said. Cliff Raskind, director of wireless enterprise strategies at Boston-based Strategy Analytics, said his first impression was that the triumvirate didn't have the clout that a trio of Microsoft, Intel and Cisco Systems Inc. might have in trying to establish standards for the Wi-Fi space. Wireless, by contrast, encompasses too many players. "You need buy-in across the board," he said. Click here to learn what vendors were plugging at this week's CTIA Wireless show. On the other hand, the life cycle for phones has shrunk to between six and eight months, forcing handset makers and carriers alike to implement new technology quickly or risk losing market share, analysts said. In a recent executive study, JupiterResearch found that 30 percent of the respondents cited poor device security as their chief barriers to adopting new wireless devices. Thirty-one percent cited poor network security. "Things do move quickly in the mobile space, and Intel is very serious in growing its communications business and putting in the marketing dollars to do so," JupiterResearch's Ask said. "When you announce with a carrier, that's good," Ask added. "I'm not sure if it's going to turn into a North American thing, though, versus a Japanese one." Asian carriers are usually on the leading edge of OS and technology advances, she said. Other analysts pointed out that NTT DoCoMo is a major player only in the GSM space, and a European and American carrier would need to sign on. None of the analysts reached for comment said they had been briefed on the TMP technology, which they found unusual. The TMP initiative creates a "boundary of trust" around some of the central components within the handheld system. The system initially boots from a trusted OS stored on a secure ROM, and through the applications processor that's checked against the Trusted Platform Module, or TPM. Data stored on removable devices such as flash cards must be securely encrypted, and the specification also lists the SIM card, used to identify the phone to the carrier, as a trusted device that can authenticate the user. Intel's Krisa said the Trusted Computing Group, which oversees the TPM specifications, will have to come up with a derivative designed for mobile handsets to minimize the platform's power consumption. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

MCI set to offer secure two-way messaging with strong encryption
by R.A. Hettinga 28 Oct '04

28 Oct '04

--- begin forwarded text

1 0

Attention Alif: RDNS is a bitch...
by R.A. Hettinga 28 Oct '04

28 Oct '04

--- begin forwarded text

3 8

Turtles all the way down... (was Re: Attention Alif: RDNS is a bitch...)
by R.A. Hettinga 28 Oct '04

28 Oct '04

At 11:50 PM -0400 10/27/04, Mail Delivery System wrote: ><measl(a)mfn.org>: host mx1.mfn.org[204.238.179.8] said: 554 > <user-119ac85.biz.mindspring.com[66.149.49.5]>: Client host rejected: >We do > not accept mail from .biz (in reply to RCPT TO command) Nope not yet... Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 3

camophone
by Riad S. Wahby 28 Oct '04

28 Oct '04

http://www.camophone.com/ Caller ID spoofing for the masses. Give them the target phone number, your phone number, and the number you want to appear on the caller ID. One wonders (1) how long this will last and (2) just how eager they'll be to bend over to the first TLA who comes along. -- Riad S. Wahby rsw(a)jfet.org

1 0