November 2004 - cypherpunks-legacy

Clean System to Zombie Bot in Four Minutes
by Eugen Leitl 30 Nov '04

30 Nov '04

Link: http://slashdot.org/article.pl?sid=04/11/30/1932245 Posted by: michael, on 2004-11-30 20:05:00 from the takes-five-minutes-to-download-patches dept. [1]Amadaeus writes "According to the latest study by USA Today and [2]Avantgarde, it takes less than [3]4 minutes for an unpatched Windows XP SP1 system to become part of a botnet. Avantgarde has the statistics in [4]their abstract. Stats of note: Although Macs and PC's got hit with equal opportunity, the XP SP1 machine was hit with 5 LSASS and 4 DCOM exploits while the Mac remained clean. The Linux desktop also was impenetrable, but only was only targeted by 0.26% of all attacks." See also our story on the [5]survival time for unpatched systems. [6]Click Here References 1. mailto:raymondlai@gmail.com 2. http://www.avantgarde.com/ 3. http://www.usatoday.com/money/industries/technology/2004-11-29-honeypot_x.h… 4. http://avantgarde.com/ttlnabstract113004.pdf 5. http://it.slashdot.org/article.pl?sid=04/08/17/1347214&tid=172 6. http://ads.osdn.com/?ad_id=5671&alloc_id=12342&site_id=1&request_id=4452725… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[ISN] Desktop Google Finds Holes
by InfoSec News 30 Nov '04

30 Nov '04

http://www.eweek.com/article2/0,1759,1730748,00.asp By Bruce Schneier November 29, 2004 Google's desktop search software is so good that it exposes vulnerabilities on your computer that you didn't know about. Last month, Google released a beta version of its desktop search software: Google Desktop Search. Install it on your Windows machine, and it creates a searchable index of your data files, including word processing files, spreadsheets, presentations, e-mail messages, cached Web pages and chat sessions. It's a great idea. Windows' searching capability has always been mediocre, and Google fixes the problem nicely. There are some security issues, though. The problem is that GDS indexes and finds documents that you may prefer not be found. For example, GDS searches your browser's cache. This allows it to find old Web pages you've visited, including online banking summaries, personal messages sent from Web e-mail programs and password-protected personal Web pages. GDS can also retrieve encrypted files. No, it doesn't break the encryption or save a copy of the key. However, it searches the Windows cache, which can bypass some encryption programs entirely. And if you install the program on a computer with multiple users, you can search documents and Web pages for all users. GDS isn't doing anything wrong; it's indexing and searching documents just as it's supposed to. The vulnerabilities are due to the design of Internet Explorer, Opera, Firefox, PGP and other programs. First, Web browsers should not store SSL-encrypted pages or pages with personal e-mail. If they do store them, they should at least ask the user first. Second, an encryption program that leaves copies of decrypted files in the cache is poorly designed. Those files are there whether or not GDS searches for them. Third, GDS' ability to search files and Web pages of multiple users on a computer received a lot of press when it was first discovered. This is a complete nonissue. You have to be an administrator on the machine to do this, which gives you access to everyone's files anyway. Some people blame Google for these problems and suggest, wrongly, that Google fix them. What if Google were to bow to public pressure and modify GDS to avoid showing confidential information? The underlying problems would remain: The private Web pages would still be in the browser's cache; the encryption program would still be leaving copies of the plain-text files in the operating system's cache; and the administrator could still eavesdrop on anyone's computer to which he or she has access. The only thing that would have changed is that these vulnerabilities once again would be hidden from the average computer user. In the end, this can only harm security. GDS is very good at searching. It's so good that it exposes vulnerabilities on your computer that you didn't know about. And now that you know about them, pressure your software vendors to fix them. Don't shoot the messenger. Bruce Schneier is CTO of Counterpane Internet Security Inc. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Desktop Google Finds Holes
by InfoSec News 30 Nov '04

30 Nov '04

http://www.eweek.com/article2/0,1759,1730748,00.asp By Bruce Schneier November 29, 2004 Google's desktop search software is so good that it exposes vulnerabilities on your computer that you didn't know about. Last month, Google released a beta version of its desktop search software: Google Desktop Search. Install it on your Windows machine, and it creates a searchable index of your data files, including word processing files, spreadsheets, presentations, e-mail messages, cached Web pages and chat sessions. It's a great idea. Windows' searching capability has always been mediocre, and Google fixes the problem nicely. There are some security issues, though. The problem is that GDS indexes and finds documents that you may prefer not be found. For example, GDS searches your browser's cache. This allows it to find old Web pages you've visited, including online banking summaries, personal messages sent from Web e-mail programs and password-protected personal Web pages. GDS can also retrieve encrypted files. No, it doesn't break the encryption or save a copy of the key. However, it searches the Windows cache, which can bypass some encryption programs entirely. And if you install the program on a computer with multiple users, you can search documents and Web pages for all users. GDS isn't doing anything wrong; it's indexing and searching documents just as it's supposed to. The vulnerabilities are due to the design of Internet Explorer, Opera, Firefox, PGP and other programs. First, Web browsers should not store SSL-encrypted pages or pages with personal e-mail. If they do store them, they should at least ask the user first. Second, an encryption program that leaves copies of decrypted files in the cache is poorly designed. Those files are there whether or not GDS searches for them. Third, GDS' ability to search files and Web pages of multiple users on a computer received a lot of press when it was first discovered. This is a complete nonissue. You have to be an administrator on the machine to do this, which gives you access to everyone's files anyway. Some people blame Google for these problems and suggest, wrongly, that Google fix them. What if Google were to bow to public pressure and modify GDS to avoid showing confidential information? The underlying problems would remain: The private Web pages would still be in the browser's cache; the encryption program would still be leaving copies of the plain-text files in the operating system's cache; and the administrator could still eavesdrop on anyone's computer to which he or she has access. The only thing that would have changed is that these vulnerabilities once again would be hidden from the average computer user. In the end, this can only harm security. GDS is very good at searching. It's so good that it exposes vulnerabilities on your computer that you didn't know about. And now that you know about them, pressure your software vendors to fix them. Don't shoot the messenger. Bruce Schneier is CTO of Counterpane Internet Security Inc. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

"F*ck the South"
by Tyler Durden 30 Nov '04

30 Nov '04

A hilarious rant. You can hear this guy's anger ain't just for show, too--> www.fuckthesouth.com -TD Fuck the South. Fuck 'em. We should have let them go when they wanted to leave. But no, we had to kill half a million people so they'd stay part of our special Union. Fighting for the right to keep slaves - yeah, those are states we want to keep. And now what do we get? We're the fucking Arrogant Northeast Liberal Elite? How about this for arrogant: the South is the Real America? The Authentic America. Really? Cause we fucking founded this country, assholes. Those Founding Fathers you keep going on and on about? All that bullshit about what you think they meant by the Second Amendment giving you the right to keep your assault weapons in the glove compartment because you didn't bother to read the first half of the fucking sentence? Who do you think those wig-wearing lacy-shirt sporting revolutionaries were? They were fucking blue-staters, dickhead. Boston? Philadelphia? New York? Hello? Think there might be a reason all the fucking monuments are up here in our backyard? No, No. Get the fuck out. We're not letting you visit the Liberty Bell and fucking Plymouth Rock anymore until you get over your real American selves and start respecting those other nine amendments. Who do you think those fucking stripes on the flag are for? Nine are for fucking blue states. And it would be 10 if those Vermonters had gotten their fucking Subarus together and broken off from New York a little earlier. Get it? We started this shit, so don't get all uppity about how real you are you Johnny-come-lately "Oooooh I've been a state for almost a hundred years" dickheads. Fuck off. Arrogant? You wanna talk about us Northeasterners being fucking arrogant? What's more American than arrogance? Hmmm? Maybe horsies? I don't think so. Arrogance is the fucking cornerstone of what it means to be American. And I wouldn't be so fucking arrogant if I wasn't paying for your fucking bridges, bitch. All those Federal taxes you love to hate? It all comes from us and goes to you, so shut up and enjoy your fucking Tennessee Valley Authority electricity and your fancy highways that we paid for. And the next time Florida gets hit by a hurricane you can come crying to us if you want to, but you're the ones who built on a fucking swamp. "Let the Spanish keep it, its a shithole," we said, but you had to have your fucking orange juice. The next dickwad who says, "Its your money, not the government's money" is gonna get their ass kicked. Nine of the ten states that get the most federal fucking dollars and pay the least... can you guess? Go on, guess. Thats right, motherfucker, they're red states. And eight of the ten states that receive the least and pay the most? Its too easy, asshole, theyre blue states. Its not your money, assholes, its fucking our money. What was that Real American Value you were spouting a minute ago? Self reliance? Try this for self reliance: buy your own fucking stop signs, assholes. Lets talk about those values for a fucking minute. You and your Southern values can bite my ass because the blue states got the values over you fucking Real Americans every day of the goddamn week. Which state do you think has the lowest divorce rate you marriage-hyping dickwads? Well? Can you guess? Its fucking Massachusetts, the fucking center of the gay marriage universe. Yes, thats right, the state you love to tie around the neck of anyone to the left of Strom Thurmond has the lowest divorce rate in the fucking nation. Think thats just some aberration? How about this: 9 of the 10 lowest divorce rates are fucking blue states, asshole, and most are in the Northeast, where our values suck so bad. And where are the highest divorce rates? Care to fucking guess? 10 of the top 10 are fucking red-ass we're-so-fucking-moral states. And while Nevada is the worst, the Bible Belt is doing its fucking part. But two guys making out is going to fucking ruin marriage for you? Yeah? Seems like you're ruining it pretty well on your own, you little bastards. Oh, but that's ok because you go to church, right? I mean you do, right? Cause we fucking get to hear about it every goddamn year at election time. Yes, we're fascinated by how you get up every Sunday morning and sing, and then you're fucking towers of moral superiority. Yeah, that's a workable formula. Maybe us fucking Northerners don't talk about religion as much as you because we're not so busy sinning, hmmm? Ever think of that, you self-righteous assholes? No, you're too busy erecting giant stone tablets of the Ten Commandments in buildings paid for by the fucking Northeast Liberal Elite. And who has the highest murder rates in the nation? It ain't us up here in the North, assholes. Well this gravy train is fucking over. Take your liberal-bashing, federal-tax-leaching, confederate-flag-waving, holier-than-thou, hypocritical bullshit and shove it up your ass. And no, you can't have your fucking convention in New York next time. Fuck off.

2 1

Notes Spotted by Soldier Lead G.I.'s to Rebel Cache
by R.A. Hettinga 29 Nov '04

29 Nov '04

<http://www.nytimes.com/2004/11/29/international/middleeast/29mosul.html?ore…> The New York Times November 29, 2004 MOSUL Notes Spotted by Soldier Lead G.I.'s to Rebel Cache By RICHARD A. OPPEL Jr. OSUL, Iraq, Nov. 28 - At first the suspect was merely one of 115 Iraqis whom American troops corralled for questioning on Saturday night in a particularly nasty part of Mosul. But his belligerence stood out. And then he made his move. Sitting where the troops had ordered him to sit - in front of an open-air cigarette store - the suspect flicked out of his pocket several folded sheets of handwritten notes. It was clear he hoped the pages would land unnoticed amid the clutter of the store just a step away. They did not. A soldier scooped them up and handed them to an Iraqi interpreter working for the Americans. "Who has this? He is an insurgent!" shouted the interpreter, known only to the soldiers as Jeff the Fighting Kurd. Jeff and another interpreter quickly translated the pages for the American officers who gathered around. One passage mentioned a proposal for a large-scale attack against American troops, according to the interpreters. Another urged attacks on the families of Iraqis thought to be working for the Americans. Another described "how to get money and use the money for jihad," an interpreter said. And still another underscored the importance of "bringing information about who is working for the U.S. forces." An American commander told embedded journalists not to report other passages - more specific, descriptive and pointed - for fear of jeopardizing efforts to gather intelligence and prevent attacks on American forces. Suddenly, the night's operation was not over. Soldiers found keys on the suspect and took him the short distance to his two-story home in Old Mosul, a densely populated warren of rundown homes in central Mosul thought to be a haven for hard-core insurgents in this northern city of two million. They walked inside, through a 15-foot-square courtyard, past two women, an elderly man, a child and a young boy, to another room packed with papers. They moved upstairs, past a flower bed, and found two rooms that contained all sorts of electronic equipment, the troops said. "There was a large stash of bomb-making material, switches, wires, just a trove of stuff," said the American commander, Lt. Col. Erik Kurilla, whose battalion controls much of western Mosul. "Papers on how to launder money and others that talked about the ineffectiveness of some of their weapons systems against us and how they need to change." A 55-gallon drum of bomb-making material and 2.5 million Iraqi dinars - about $1,700 - was also found, he said. The papers retrieved from the man in front of the cigarette stand, he said, were "minutes from some type of meeting of terrorist cells where they discussed money laundering, recruitment, weapons effectiveness and future operations." This is how it goes in the war against the insurgents in Mosul. Apparently having learned that direct attacks on American troops and their heavily armored vehicles are a difficult if not suicidal approach, insurgents often keep to the confines of sympathetic neighborhoods. They come out to try to pick off American troops patrolling the city or to launch mortars at American bases. But most of their efforts lately have been to kidnap, brutalize and kill young Iraqis who have joined the nation's new security forces or who are thought to be helping the Americans. So for American troops here, success often means catching a break or two from a steady routine of raids and searches into places like Old Mosul, a one-square-mile district in the center of the city that is home to as many as 500,000 people. Sometimes troops go into insurgent areas for the principal purpose of drawing their fire - so the Americans can shoot back and capture or kill them. Such missions are very frustrating when the insurgents do not take the bait, as was the case during a rainy three-hour operation into Old Mosul last week. But on Saturday, the troops had help. Riding in a 19-ton armored Stryker vehicle was "the source," an informant who, despite never leaving the vehicle, was bedecked in a full-face scarf, a Kevlar helmet, and large black sunglasses. Using informants can be tricky business, Colonel Kurilla is quick to concede. They can be motivated by revenge, and some do not have a good track record. With the informant in tow, troops raided an Old Mosul mosque and surrounding homes in the morning, detaining eight people whom the informant - peering through an on-board video monitor linked to a large camera atop the Stryker - identified as insurgents. But there was not much evidence. The most excited one of the Iraqi commanders became was when he brought a pair of rubber boots out of a home and laid them at the feet of several American soldiers, exclaiming, "Ali Baba!" The troops, mystified, went inside the house and found a dozen pairs of boots, and nothing else. But for the troops, Saturday night offered a welcome payoff. The troops arrived at an intersection in Old Mosul at about 5:30 p.m. and began rounding up people near a mosque and a social club where men were playing cards on the second floor. Only toward the end of the mission did the handwritten notes appear - confirming, in the view of the soldiers, that they had found some bad guys. "This is a very good night," said Capt. Matthew McGrew. "They're somebody." He added that if they were not insurgent fighters, "they're one of the terrorist cells working against us." "We know they're bad," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Some Secret: Open House, Open Bar
by R.A. Hettinga 29 Nov '04

29 Nov '04

>Must have passed some kinda big supplemental. Cheers, RAH ------- <http://www.washingtonpost.com/ac2/wp-dyn/A8583-2004Nov23?language=printer> The Washington Post washingtonpost.com Round-Trip or One-Way Tickets? By Al Kamen Wednesday, November 24, 2004; Page A19 Some Secret: Open House, Open Bar Remember a while back when it came out that intelligence agencies such as the National Security Agency -- the supersecret spy crowd -- did not have the resources to keep up with the flood of intercepts to be able to translate terrorists' chatter on a timely basis? This naturally caused a big fuss, and Congress pledged big bucks to get the spooks up to speed. Seems to have worked out fine, judging from an invite we got to attend an open house Dec. 7 at the National Cryptologic Museum behind the Shell station at Fort Meade. Lots of fine finger food to be had, including a "brie encrote with brown sugar and pecans," some "Swiss cheese and chablis stuffed mushroom caps," a bit of roast turkey with cranberry mayo and "mini pumpkin cheesecakes." Our very fine invite with the NSA gold-embossed seal notes "Open bar." Must have passed some kinda big supplemental. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

geographically removed?
by Major Variola (ret) 29 Nov '04

29 Nov '04

At 09:42 PM 11/25/04 -0500, Tyler Durden wrote: >Well, I guess I agree. However, there is some issues of Cypherpunkly >importance here, particularly concerning nation-states fighting other >nation-states. Though I can't consider myself a true-believing anarchist, my >own personal reason for continuing to post on the subject was to illustrate >that, as long as Group-of-Bandits X continues to utilize our tax dollars to >fuck over geographically removed Group of Bandits Y (and their citizenry), Internal resistance mediated by cypherpunkly tech can always be defeated by cranking up the police state a notch. This is eg why e-cash systems have anonymity problems. This is why there are carnivore boxen aplenty. The knurls on the police-state knob are getting worn, it is cranked up so frequently now. Useful resistance comes from asymmetric physical feedback such as experienced in Lebanon, S. Arabia, off the coast of Yemen, in a few embassies somewhere in africa, in the trains of Madrid, Okla city, and some degenerate US east coast cities a few years back, the latter indicating that "geographically removed" is less important, and the only incident that Joe Voter is likely to remember. Until the next one, of course; Joe's buffer is not terribly capacious. ---- A free people ought not only to be armed and disciplined, but they should have sufficient arms and ammunition to maintain a status of independence from any who might attempt to abuse them, which would include their own government. --George Washington

4 5

Patriot Insurance
by Will Morton 29 Nov '04

29 Nov '04

"US Patriot Financial (USPF) exists to help Americans, who risk their lives making this world a better place, obtain life insurance. This includes resident aliens. Whether you are a soldier deploying overseas, a DOD contractor helping to rebuild war torn countries, a missionary volunteering to help the most needy, or a business man or woman traveling the globe to support our economy we can help. Using our extensive network of life insurance carriers, we are able to provide protection to those whose service leads them into some of the world's most dangerous places. This includes US citizens living abroad." http://www.uspfinancial.com/ How long have soldiers deployed in war-zones been able to get life insurance? Would love to see their actuarial process... W

6 6

ADV: Staff Announcement
by Administrator 29 Nov '04

29 Nov '04

Attention All Nonprofit Organizations: Members and Staff You Must Respond By 5 P.M. Wednesday, December 1, 2004. Through a special arrangement, Avtech Direct is offering a limited allotment of BRAND NEW, top of-the-line, name-brand desktop computers at more than 50% off MSRP to all Nonprofit Members and Staff who respond to this message before 5 P.M., Wednesday, December 1, 2004. All desktop computers are brand-new packed in their original boxes, and come with a full manufacturer's warranty plus a 100% satisfaction guarantee. These professional grade Desktops are fully equipped with 2005 next generation technology, making these the best performing computers money can buy. Avtech Direct is offering these feature rich, top performing Desktops with the latest technology at an amazing price to all who call: 1-800-795-8466 by 5 P.M. Wednesday, December 1, 2004 The fast and powerful AT-3200 series Desktop features: * IBM Processor for amazing speed and performance * 128MB DDR RAM, -- Upgradeable to 1024 * 20 GB UDMA Hard Drive, -- Upgradeable to 80 GB * 52X CD-Rom Drive, -- Upgradeable to DVD/CDRW * Next Generation 2005 Technology * Premium video and sound -- For enhanced colors and graphics * Full Connectivity with Fax modem/Lan/IEE 1394/USB 2.0 * Soft Touch Keyboard and scroll mouse * Internet Ready * Network Ready * 1 Year parts and labor warranty * Priority customer service and tech support MSRP $499 ........................................ Your Cost $227 How to qualify: 1. You must be a Member, Staff or Associate of a Nonprofit. 2. All desktop computers will be available on a first come first serve basis. 3. You must call 1-800-795-8466 by 5 P.M. Wednesday, December 1, 2004. and we will hold the desktops you request on will call. 4. You are not obligated in any way. 5. 100% Satisfaction Guaranteed. 6. Ask for Department C. Call Avtech Direct 1-800-795-8466 before 5 P.M. Wednesday, December 1, 2004 Visit our website at http://www.avtechcomputers.com If you wish to unsubscribe from this list, please go to http://www.avtechcomputers.com/announcements.asp Avtech Direct 22647 Ventura Blvd. Suite 374 Woodland Hills, CA 91364

1 0

Re: Tin Foil Passports?
by Major Variola (ret) 29 Nov '04

29 Nov '04

At 09:13 AM 11/27/04 +0100, Eugen Leitl wrote: >Link: http://slashdot.org/article.pl?sid=04/11/27/0026222 >Posted by: michael, on 2004-11-27 05:05:00 > low-cost solution: '[I]incorporate a layer of metal foil into the > cover of the passport so it could be read only when opened.' Don't > they know that the whole tinfoil hat thing is supposed to be a joke?" What is most poignant about this post is the lack of education of /. authors. Don't they teach Maxwell any more? Is Faraday just the guy who said "Sir, I do not know what it is good for. But of one thing I am quite certain--someday you will tax it." Put your cell phone in a metal tin, and call it. Wrap your access point or receiver or other radio in Al foil. Do you think Brin in _Enemy of the State_ was just a potato-chip fetishist?

4 3