November 2004 - cypherpunks-legacy

[ISN] E-gold Tracks Cisco Code Thief
by InfoSec News 08 Nov '04

08 Nov '04

http://www.eweek.com/article2/0,1759,1713878,00.asp By Michael Myser November 5, 2004 The electronic currency site that the Source Code Club said it will use to accept payment for Cisco Systems Inc.'s firewall source code is confident it can track down the perpetrators. Dr. Douglas Jackson, chairman of E-gold Ltd., which runs www.e-gold.com, said the company is already monitoring accounts it believes belong to the Source Code Club, and there has been no activity to date. "We've got a pretty good shot at getting them in our system," said Jackson, adding that the company formally investigates 70 to 80 criminal activities a year and has been able to determine the true identity of users in every case. On Monday, a member of the Source Code Club posted on a Usenet group that the group is selling the PIX 6.3.1 firewall firmware for $24,000, and buyers can purchase anonymously using e-mail, PGP keys and e-gold.com, which doesn't confirm identities of its users. "Bad guys think they can cover their tracks in our system, but they discover otherwise when it comes to an actual investigation," said Jackson. The purpose of the e-gold system, which is based on 1.86 metric tons of gold worth the equivalent of roughly $25 million, is to guarantee immediate payment, avoid market fluctuations and defaults, and ease transactions across borders and currencies. There is no credit line, and payments can only be made if covered by the amount in the account. Like the Federal Reserve, there is a finite value in the system. There are currently 1.5 million accounts at e-gold.com, 175,000 of those Jackson considers "active." To have value, or e-gold, in an account, users must receive a payment in e-gold. Often, new account holders will pay cash to existing account holders in return for e-gold. Or, in the case of SCC, they will receive payment for a service. The only way to cash out of the system is to pay another party for a service or cash trade, which Jackson said creates an increasingly traceable web of activity. He did offer a caveat, however: "There is always the risk that they are clever enough to figure out an angle for offloading their e-gold in a way that leads to a dead end, but that tends to be much more difficult than most bad guys think." This is all assuming the SCC actually receives a payment, or even has the source code in the first place. It's the ultimate buyer bewarethe code could be made up, tampered with or may not exist. And because the transaction through e-gold is instantaneous and guaranteed, there is no way for the buyer to back out. Dave Hawkins, technical support engineer with Radware Inc. in Mahwah, N.J., believes SCC is merely executing a publicity stunt. "If they had such real code, it's more likely they would have sold it in underground forums to legitimate hackers rather than broadcasting the sale on Usenet," he said. "Anyone who did have the actual code would probably keep it secret, examining it to build private exploits. By selling it, it could find its way into the public, and all those juicy vulnerabilities [would] vanish in the next version." "There's really no way to tell if this is legitimate," said Russ Cooper, senior scientist with security firm TruSecure Corp. of Herndon, Va. Cooper, however, believes there may be a market for it nonetheless. By posting publicly, SCC is able to get the attention of criminal entities they otherwise might not reach. "It's advertising from one extortion team to another extortion team," he said. "These DDOS [distributed denial of service] extortionists, who are trying to get betting sites no doubt would like to have more ways to do that." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] E-gold Tracks Cisco Code Thief
by InfoSec News 08 Nov '04

08 Nov '04

http://www.eweek.com/article2/0,1759,1713878,00.asp By Michael Myser November 5, 2004 The electronic currency site that the Source Code Club said it will use to accept payment for Cisco Systems Inc.'s firewall source code is confident it can track down the perpetrators. Dr. Douglas Jackson, chairman of E-gold Ltd., which runs www.e-gold.com, said the company is already monitoring accounts it believes belong to the Source Code Club, and there has been no activity to date. "We've got a pretty good shot at getting them in our system," said Jackson, adding that the company formally investigates 70 to 80 criminal activities a year and has been able to determine the true identity of users in every case. On Monday, a member of the Source Code Club posted on a Usenet group that the group is selling the PIX 6.3.1 firewall firmware for $24,000, and buyers can purchase anonymously using e-mail, PGP keys and e-gold.com, which doesn't confirm identities of its users. "Bad guys think they can cover their tracks in our system, but they discover otherwise when it comes to an actual investigation," said Jackson. The purpose of the e-gold system, which is based on 1.86 metric tons of gold worth the equivalent of roughly $25 million, is to guarantee immediate payment, avoid market fluctuations and defaults, and ease transactions across borders and currencies. There is no credit line, and payments can only be made if covered by the amount in the account. Like the Federal Reserve, there is a finite value in the system. There are currently 1.5 million accounts at e-gold.com, 175,000 of those Jackson considers "active." To have value, or e-gold, in an account, users must receive a payment in e-gold. Often, new account holders will pay cash to existing account holders in return for e-gold. Or, in the case of SCC, they will receive payment for a service. The only way to cash out of the system is to pay another party for a service or cash trade, which Jackson said creates an increasingly traceable web of activity. He did offer a caveat, however: "There is always the risk that they are clever enough to figure out an angle for offloading their e-gold in a way that leads to a dead end, but that tends to be much more difficult than most bad guys think." This is all assuming the SCC actually receives a payment, or even has the source code in the first place. It's the ultimate buyer bewarethe code could be made up, tampered with or may not exist. And because the transaction through e-gold is instantaneous and guaranteed, there is no way for the buyer to back out. Dave Hawkins, technical support engineer with Radware Inc. in Mahwah, N.J., believes SCC is merely executing a publicity stunt. "If they had such real code, it's more likely they would have sold it in underground forums to legitimate hackers rather than broadcasting the sale on Usenet," he said. "Anyone who did have the actual code would probably keep it secret, examining it to build private exploits. By selling it, it could find its way into the public, and all those juicy vulnerabilities [would] vanish in the next version." "There's really no way to tell if this is legitimate," said Russ Cooper, senior scientist with security firm TruSecure Corp. of Herndon, Va. Cooper, however, believes there may be a market for it nonetheless. By posting publicly, SCC is able to get the attention of criminal entities they otherwise might not reach. "It's advertising from one extortion team to another extortion team," he said. "These DDOS [distributed denial of service] extortionists, who are trying to get betting sites no doubt would like to have more ways to do that." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Velva Klaessy, government code breaker, dies at 88
by InfoSec News 08 Nov '04

08 Nov '04

http://www.startribune.com/stories/462/5072390.html Trudi Hahn Star Tribune November 7, 2004 Velva Klaessy, a government cryptanalyst who accomplished some firsts for female code breakers -- with accompanying problems in the male-dominated field -- died Sept. 16 in Golden Valley. She was 88. "She could never talk about it," said her brother Dale Klaessy of Minnetonka. "It was a lonely, lonely job." Born to a farm couple in 1915 in Renwick, Iowa, Klaessy got a scholarship during the Depression to attend what is now Northern Iowa University. With no money to buy clothes, her father bought her 500 baby chicks to raise. When she sold them, she bought fabric and made her wardrobe. She received her degree in math in 1937 and took her first job in a small town dominated by a Protestant congregation. It decreed that the public-school teachers weren't allowed to play cards or go to the movies. After the town protested that she was insulting its sons by dating a young man from a different town, she left at the end of the year. In 1944, she was teaching high school math and science in Cherokee, Iowa, when a government recruiter came to ask if she had any students good in math who might want to join the war effort as a cryptologist in the Army Signal Corps. Her best students were all headed for college, so she didn't want to recommend them, but she took the job herself. After World War II she stayed in the field as the Armed Forces Security Agency and the National Security Agency (NSA) were formed. Although much of her work remains classified, information from the National Cryptologic Museum of the NSA, based at Fort Meade, Md., states that she was a member for many years of the highly respected Technical Consultants group, which assisted other analytic offices with their most difficult problems. In the summer of 1953, she and a male officer were posted temporarily to the Far East to train military personnel. According to oral tradition, the museum said, female NSA employees had never gotten temporary posts in that part of the world. Before she left the consultants group, she was posted temporarily to the United Kingdom. Her British counterpart threw a welcoming party -- in a men's club from which women were barred, her brother said. Female NSA employees battled for recognition at home, too. At one point a supervisor told her that she had earned a promotion but he was giving it to a male co-worker "because he had a family," her brother said. From 1958 to 1967, Klaessy finally received positions of high responsibility in sectors dealing with cutting-edge technology, the museum said, including being named chief in 1964 of the New and Unidentified Signals Division. She returned in 1967 to what is now called the extended enterprise when she was named deputy senior U.S. liaison officer in Ottawa, Canada. In 1970 she was named senior liaison officer in Ottawa, becoming the first woman to hold the senior post anywhere in the world. As senior officer, she represented the U.S. Intelligence Board and the NSA with appropriate organizations in Canada in all matters about signal intelligence and communications security. She returned to Fort Meade in 1975 but retired shortly afterward to care for ill relatives, her brother said. She was found to have Parkinson's disease about 1987 and moved to the Twin Cities to be close to relatives. In addition to her brother Dale, survivors include another brother, Earl of Spencer, Iowa. Services have been held in Iowa. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Velva Klaessy, government code breaker, dies at 88
by InfoSec News 08 Nov '04

08 Nov '04

http://www.startribune.com/stories/462/5072390.html Trudi Hahn Star Tribune November 7, 2004 Velva Klaessy, a government cryptanalyst who accomplished some firsts for female code breakers -- with accompanying problems in the male-dominated field -- died Sept. 16 in Golden Valley. She was 88. "She could never talk about it," said her brother Dale Klaessy of Minnetonka. "It was a lonely, lonely job." Born to a farm couple in 1915 in Renwick, Iowa, Klaessy got a scholarship during the Depression to attend what is now Northern Iowa University. With no money to buy clothes, her father bought her 500 baby chicks to raise. When she sold them, she bought fabric and made her wardrobe. She received her degree in math in 1937 and took her first job in a small town dominated by a Protestant congregation. It decreed that the public-school teachers weren't allowed to play cards or go to the movies. After the town protested that she was insulting its sons by dating a young man from a different town, she left at the end of the year. In 1944, she was teaching high school math and science in Cherokee, Iowa, when a government recruiter came to ask if she had any students good in math who might want to join the war effort as a cryptologist in the Army Signal Corps. Her best students were all headed for college, so she didn't want to recommend them, but she took the job herself. After World War II she stayed in the field as the Armed Forces Security Agency and the National Security Agency (NSA) were formed. Although much of her work remains classified, information from the National Cryptologic Museum of the NSA, based at Fort Meade, Md., states that she was a member for many years of the highly respected Technical Consultants group, which assisted other analytic offices with their most difficult problems. In the summer of 1953, she and a male officer were posted temporarily to the Far East to train military personnel. According to oral tradition, the museum said, female NSA employees had never gotten temporary posts in that part of the world. Before she left the consultants group, she was posted temporarily to the United Kingdom. Her British counterpart threw a welcoming party -- in a men's club from which women were barred, her brother said. Female NSA employees battled for recognition at home, too. At one point a supervisor told her that she had earned a promotion but he was giving it to a male co-worker "because he had a family," her brother said. From 1958 to 1967, Klaessy finally received positions of high responsibility in sectors dealing with cutting-edge technology, the museum said, including being named chief in 1964 of the New and Unidentified Signals Division. She returned in 1967 to what is now called the extended enterprise when she was named deputy senior U.S. liaison officer in Ottawa, Canada. In 1970 she was named senior liaison officer in Ottawa, becoming the first woman to hold the senior post anywhere in the world. As senior officer, she represented the U.S. Intelligence Board and the NSA with appropriate organizations in Canada in all matters about signal intelligence and communications security. She returned to Fort Meade in 1975 but retired shortly afterward to care for ill relatives, her brother said. She was found to have Parkinson's disease about 1987 and moved to the Twin Cities to be close to relatives. In addition to her brother Dale, survivors include another brother, Earl of Spencer, Iowa. Services have been held in Iowa. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[p2p-hackers] Anti-censorship Proxy Networks (without the HTML this time - sorry!) (fwd from paul@paulbaranowski.org)
by Eugen Leitl 08 Nov '04

08 Nov '04

----- Forwarded message from Paul Baranowski <paul(a)paulbaranowski.org> -----

1 0

RE: The Values-Vote Myth
by John Kelsey 08 Nov '04

08 Nov '04

>From: "J.A. Terranson" <measl(a)mfn.org> >Sent: Nov 6, 2004 5:07 PM >To: Tyler Durden <camera_lumina(a)hotmail.com> >Cc: rah(a)shipwright.com, cypherpunks(a)al-qaeda.net >Subject: RE: The Values-Vote Myth >On Sat, 6 Nov 2004, Tyler Durden wrote: ... >> So: A 'moral values' question for Cypherpunks. Does this election indict the >> American people as being complicit in the crime known as "Operation >> Freedom"? (I notice everyone forgot about that name.) >Complicit? Thats *technically* correct, but not nearly strong enough. Similarly, if I hold some stock in Exxon, am I complicit in every crime done by the management of Exxon? How does this change if I'm a child whose trust fund contains the stock? Or if I hold a mutual fund I inherited with a little Exxon stock, which can be sold off only if I'm willing to move thousands of miles from my home, learn a new language, uproot my family, etc.? Is there any outcome of the election that would have made it immoral to attack Americans? (Certainly not electing Kerry, who planned to continue holding down Iraq for the forseeable future, though he correctly stated that invading it was a mistake in the first place.) And if we accept this kind of collective guilt logic, why is, say, flattening Fallujah to make an example for the rest of Iraq, wrong? > -TD >J.A. Terranson --John

1 0

Re: Your source code, for sale
by Tyler Durden 08 Nov '04

08 Nov '04

Oh, I assumed that this verification 'layer' was disjoint from the e$ layer. In other words, you might have a 3rd party e$ issuer, but after that they shouldn't be necessary....or, there's a different 3rd party for the verification process. I think that's reasonable, but of course one could argue "what's the point if you already need a 3rd party for the e$". But I think that's a disjoint set of issues. -TD >From: Ben Laurie <ben(a)algroup.co.uk> >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: chris.kuethe(a)gmail.com, cypherpunks(a)al-qaeda.net >Subject: Re: Your source code, for sale >Date: Mon, 08 Nov 2004 11:50:28 +0000 > >Tyler Durden wrote: >> >>>What if I block the outbound "release the money" message after I >>>unbundle the images. Sure, I've already committed my money, but you >>>can't get to it. In effect I've just ripped you off, because I have >>>usable product and you don't have usable money. >> >> >>Well, yes, but this would be a very significant step forward from the >>current situation. As t-->infinity the vast majority of non-payments are >>going to be for the purpose of greed. If the payment is already 'gone', >>then you need a whole different set of motives for wanting to screw >>somebody even if you get nothing out of it. So in other words, you have at >>least solved the payment problem "to the first order", with no 3rd party. >>With fancier mechanisms I would think you can solve it to 2nd order too. > >How do you make the payment already "gone" without using a third party? _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

[ISN] Velva Klaessy, government code breaker, dies at 88
by R.A. Hettinga 08 Nov '04

08 Nov '04

--- begin forwarded text

1 0

[ISN] E-gold Tracks Cisco Code Thief
by R.A. Hettinga 08 Nov '04

08 Nov '04

--- begin forwarded text

1 0

How organized religion, not net religion, won it for Bush
by R.A. Hettinga 08 Nov '04

08 Nov '04

<http://www.theregister.co.uk/2004/11/05/jesus_blog_dems/print.html> The Register Biting the hand that feeds IT How organized religion, not net religion, won it for Bush By Ashlee Vance in Chicago (ashlee.vance at theregister.co.uk) Published Friday 5th November 2004 17:21 GMT Election 2004 Technophobes and luddites won the election for George W Bush in 2004, not technology-toting bloggers, by turning out the vote. The giant, self-congratulatory humpfest that is the blogger nation really didn't do much at all for the Democrats, despite Joe Trippi telling anyone who'll listen that the internet transformed politics. For voter turn-out was markedly higher in the states with the lowest broadband penetration. Hawaii, Massachusetts, New Jersey, Connecticut, New York and California have the highest broadband penetration and all went to Kerry. Meanwhile, Mississippi, South Dakota, Montana, Wyoming and New Mexico have the lowest penetration and all went to Bush. But the rise in votes was proportionately higher in states where the internet doesn't reach so many people. In blogless Mississippi, Bush received 666,000 votes in 2004 compared to 549,000 in 2000. That's more than a 20 per cent increase in votes. (Somehow we doubt that P. Diddy threatening youngsters in Mississippi to "Vote or Die" did much to inspire youth turnout.) Kerry picked up 440,000 in Mississippi compared to Gore's 400,000 votes - about a 10 per cent difference. What about a battleground, internet-wary state like New Mexico? The Land of Enchantment chucked 370,000 votes Bush's way in 2004 compared to 286,000 in 2000, when Bush lost the state. Kerry picked up 362,000 compared to Gore's 286,000. These numbers prove little other than that voting totals increased handily and always in Bush's favor in states largely considered lacking in IT but strong in Jesus. In broadband rich Connecticut, Kerry picked up 848,000 votes compared to Gore's 796,000. That's close to a 6 per cent rise. Bush earned 687,000 votes in 2004 compared to 546,000 in 2000. That's a handy 26 per cent gain. In New Jersey, the story is similar. Kerry pulled in 1.8m votes compared to Gore's 1.75m. Bush, however, nabbed 1.6m votes in 2004 versus 1.3m in 2000. With all those statistics out of the way, we're left with one conclusion. A year ago we were told (http://www.theregister.co.uk/2003/11/14/one_blogger_is_worth_ten/) that One Blogger is Worth Ten Votes. In reality, however, it may be easier for a camel to pass through the eye of a needle than for bloggers to deliver you the election. This is the most obvious and frivolous takeaway from this year's election/revival. For months, the internet was buzzed by so-called citizen journalists - otherwise known as message board tools - who convinced each other that they were making a difference. They often analyzed their own convincing and then concluded that they were indeed right. Then W. won and did so by a larger margin than in 2000. But has anyone told Joe Trippi? A long strange Trippi "What has been amazing this year is the creativity of Generation E's members to spur and engage more of its generation to become involved and make a difference," Trippi claims in his blog. And later on, (http://www.joetrippi.com/node/view/753) he writes - "Young Americans are awake like never before and studies show the earlier a voter becomes an active voter the more likely they are to be active voters throughout their life. Politicians beware. A generational giant has been awakened." There are so many things wrong with this, and with Trippi himself, that it's hard to know where to begin. Let's at least start by looking at what the droopy god of blog scum was trying to explain. Trippi questions the numerous analysts who don't believe the youth vote was all that spectacular this election. There were more young voters, but there were more voters period as a result of population increases and shared hatred. Trippi tells us that the pundits are missing the point. Close to 10 per cent more young voters showed up this time around, the youngsters "were especially active in battleground states," and many voted with absentee ballots, meaning they were missed by exit polls. If, however, more young people did show up, they weren't terribly impressive. All week long, Joe Trippi dangled his jowls on MSNBC, on the basis of an unsuccessful campaign, and we seem to remember (http://www.theregister.co.uk/2004/01/28/dean_campaign_waves_net_guru/) for getting himself sacked after boosting his favorite DRM company while getting the dumb Doc to advocate TCPA: the lock-down computing Microsoft wants to build into Windows to stop you sharing music. Again and again, he promised that the internet and bloggers would bring out the youth vote. NPR gladly repeated this almost every day. And then, like Zogby, he stuck to his promises despite so much evidence to the contrary. Again and again, he told America that Kerry had pulled in eight times as much money as Bush online. The perky MSNBC drones next to him guffawed at the rich evidence of web success. The blogger army fell right into line behind Trippi. It told itself how awful W was. It told itself how much "it" matters - how it showed those swift boat veterans a thing or two. How the internet is freedom and how rapid communication is "pretty awesome," as our president might say. "I've written a lot in my "Trippi's Take" columns about how the Internet empowers the bottom, and how that empowerment energizes citizen involvement that can create real change in an otherwise top-down world," Trippi again writes. Trippi isn't the only one to blame. All the blogging believers are at fault. Even if Jesus set up a blogging cafe in the center of Rockport, Texas and extolled the virtues of a woman's right to choose while snapping pictures of gay weddings with his Nokia, it would have made no difference to this election. All of the bloggers would have told themselves about the miracle, while Bobby and Bobby Sue went right along with their business. The longer the Democrats pretend that their vacuum of righteousness is actually reaching the public at large, helped by NPR, the more trouble they will be in. Be it an internet wasteland like New Mexico or fat pipe rich Connecticut, it doesn't matter. George W. Bush kicked your blogging ass. Now internet zombies need to take lessons from those Dems that actually got out and participated in the world. Most of the evangelicals in Alabama certainly weren't reading georgeisthebest.typepad.com to summon up their inspiration to vote. No, they had a fearless leader screaming at them about fear and impending doom. If the Democrats want to make some gains over the next four years, they'd be well suited to get a message with some substance and weight instead hoping that empty technology will somehow save them. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0