December 2004 - cypherpunks-legacy

Do 'Ocean's Twelve'-Style Heists Really Happen?
by R.A. Hettinga 15 Dec '04

15 Dec '04

This popped up in my "bearer" filter this morning... Cheers, RAH ------- <http://www.mtv.com/movies/news/articles/1494863/12142004/story.jhtml> MTV.com - Movies - News 12.14.2004 9:03 PM EST Reel To Real: Do 'Ocean's Twelve'-Style Heists Really Happen? Sometimes, but the real-life criminals can't possibly be as hot as George Clooney and Brad Pitt. While dodging nemesis Terry Benedict (Andy Garcia), Danny Ocean (Clooney) and Rusty Ryan (Pitt) plan the biggest and most difficult job of their now-storied careers. As the stakes rise higher and higher, even Ocean's straight-arrow wife, Tess (Roberts), gets involved. With astronomical amounts being bandied about, we couldn't help but wonder: What was the biggest heist ever pulled? The Real Story: There have been quite a few enormous heists over the years, several of which bear mentioning here. Art thieves tend to pull the biggest scores (in terms of dollar value, if not creativity). In 1991, in a heist worthy of Ocean's crew, thieves made off with 20 paintings worth about $500 million from the Van Gogh Museum in Amsterdam, Holland. The robbers pulled a basic "smash and grab," going up a ladder and through a window and heading back out with some of Van Gogh's most famous works, including "The Potato Eaters" and "Still Life With Sunflowers." However, in a very un-Ocean move, the thieves - after presumably panicking - ditched the paintings not far from the museum. Still, according to "Guinness World Records," it was technically the greatest art robbery ever. The biggest heist in U.S. history - and the biggest "successful" art heist - was a $300 million score from Boston's Isabella Stewart Gardner Museum in 1990. The thieves - who pulled the old "walk in the front door dressed like cops" routine - made off with works by Vermeer, Rembrandt and Manet. All of the paintings are still missing, and the perpetrators are still at large. CNN.com reported in 2002 that the FBI is still actively investigating the case, so perhaps that whole "crime doesn't pay" thing will enter in at some point. Some thieves prefer to kick it old-school, including the man behind the world's largest mugging, which took place in London in 1990 (a good year for crime, it seems). In a heist typical of Matt Damon's Linus, a man mugged a courier carrying a briefcase containing 300 bearer bonds worth a total of $435 million. Pretty impressive, except that within hours every major bank had been informed that the bonds were stolen, rendering them virtually worthless. Finally, our favorite heist - history's richest jewel robbery - truly smacks of the skilled Ocean crew. The heist took place at the Antwerp Diamond Center in Antwerp, Belgium, and netted the thieves an estimated $100 million in gems. No alarms were triggered, the bombproof vault doors were not tampered with and there was no sign of a break-in, so no one knows when 123 of the 160 vaults were actually emptied. The crime was discovered on February 17, 2003, and, according to BBC News, is believed to have been carried out by a veteran group of Italian thieves known only as the School of Turin. While the heists carried out by Ocean and his gang are highly improbable, they are not altogether impossible. And, just like in the movies, things don't always go in the thieves' favor. One major difference between reel and real on this one, though: We doubt that any of these professional criminals are as hot as Clooney and Pitt. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

New, revollutionaary peenjs enlaargment tool! cocksure
by Sam Bermudez 15 Dec '04

15 Dec '04

1 0

[ISN] Done the crime, now it's Mitnick's time
by R.A. Hettinga 15 Dec '04

15 Dec '04

--- begin forwarded text

1 0

Cryptography Research wants piracy speed bump on HD DVDs
by R.A. Hettinga 15 Dec '04

15 Dec '04

<http://www.theregister.co.uk/2004/12/15/cryptography_research/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Cryptography Research wants piracy speed bump on HD DVDs By Faultline (peter at rethinkresearch.biz) Published Wednesday 15th December 2004 11:49 GMT Analysis Just about a year from today, if not sooner, if we believe the outpourings of both the DVD Forum and the Blu-Ray Disc Association, we will be able to go out to the shops and buy blue laser, high definition, high density DVDs in two completely different designs. We will also be able to buy the players and recorders by then, as well as studio content from virtually every major studio in the world, on one or the other system. If you believe the hype, DVD manufacturers will likely have to buy in two types of DVD manufacturing equipment. Households will have to buy two DVD players. Consumers will have to buy one PC with one type of high density DVD player and buy another separate player to read the other format of disk. We neither believe the hype, nor understand the argument between the two formats. Surely a single format is better for everyone, but it appears not. Every round of format wars that have gone on since the original VHS Betamax wars, has been split, and the result a draw, and it looks like this one will be too. In the end the devices are likely to be virtually identical. The Sony- Panasonic-Philips camp that inspired the Blu-ray version may have slightly more capacity on their discs, that's the official view right now, but it might change. They also have devices out right now and have had them for over a year, but they are very expensive, up at around $2,000 and are not the volume versions that will be able to play pre-recorded material. Eventually these devices will be about 10 per cent more than DVD players are now. The DVD Forum backed Toshiba and NEC technology may be slightly cheaper for studios to manufacture, but then again we only have the word of Toshiba on that, and most DVD producers seem set on supporting both. The disks need to play on PCs, as well as DVDs and games consoles, and it is unlikely that anyone is going to shoot themselves in the foot by making a disc that is incompatible with any of these devices. So Microsoft's VC 9 codec has to be supported, as does the prevalent MPEG2 and H.264 codecs, and nobody is planning to argue the toss about the quality of sound from Dolby. So there is a chance that all of the software on top of these disks is going to be identical. In the end all of the Blu-ray manufacturers are still in the DVD Forum, and given that the Blu-ray leaders make about 90 per cent of the worlds DVD players and that half of the studios have backed the DVD Forum standard, their players may well end up playing both formats. The early consumers may well be asking "What's the difference" a year from now having little clue as to how different the two technologies are, under the "hood." But what if they each choose a different way to protect the content on their disks? How much danger would that put the two groups in? The Content Scrambling System of the DVD has come in for a lot of criticism over the years, as piracy has become relatively rampant. It was designed more or less as a speed bump to put off anyone other than the professional pirate. But then along came the internet, and it has become possible for anyone to download CSS circumvention or to read up, on various websites, how to go about it. The speed bump has been somewhat flattened and it needs reinforcement in the next technology. So it falls to these same companies to build something for the studios that will be rather harder and more persuasive, to act as a hurdle against piracy for these new DVDs. In fact an organization called Advanced Access Content System (AACS), formed back in July by such notables as IBM, Intel, Microsoft, Panasonic, Sony, Toshiba, Disney and Warner Brothers has come together in order to create a decent speed bump against piracy that should last at least for the next decade, a decade during which broadband lines improve to the point where it will be child's play to download even a high definition movie. The definition of what is required has been very clear from the studios. They want a system that has the ability for the security logic to be renewed and which should also have some form of forensic marking in order to help track pirates. At the heart of this protection system will be the safety of the revenue of all the major studios, which now get way in excess of 50 per cent of any given film's revenues from DVD sales. Faultline talked over such a system with its authors this week, who are optimistic about its bid to become the new, but more sophisticated CSS for the next generation DVD disk. Cryptographic Research's senior security architect, who also mockingly refers to himself as "chief anti-pirate" is Carter Laren, and Cryptography Research is both realistic about just what it takes to stop pirates and how difficult that is, as well as optimistic that the two competing associations are set to choose its own submission as the basis for this protection system. Cryptography Research (CR) is just a 15 man intellectual property company, but it was single handedly responsible for discovering how professional pirates use Differential Power Analysis to read encryption keys and break complex coding systems thought to be uncrackable, and has also come up with circumvention strategies. Virtually all the intellectual property around DPA is held by CR and is licensed all over the world. CR also wrote the SSL3 secure sockets layer security version for the IETF. Put simply DPA is a system of "listening" to power distribution on semiconductors as they read encryption keys. Circumvention comes from balancing out all power use when an encryption key is being applied so that it cannot be read just by observing which circuits are active. If it appears to you that DPA is really about making it harder for the "professional" pirate who makes a fortune from illicit manufacture of pirated goods, rather than about stopping college kids from using P2P networks to swap files, then you'd be right. "We would rather chase professional pirates than College students," says Laren, and this shows in his strategy to build a protection system. What CR has built, he calls Self Protecting Digital Content or SPDC. In effect this is a form of content that is no longer passive and includes code that can execute in a specially constructed SPDC virtual machine that resides in each player. The logic behind this approach is that so far Digital Rights Management systems have tried to both support a trust chain, a way of moving decryption keys around between devices, as well as allowing the expression of rules to decide what usage is allowed with that content. What CR does instead is much simpler and more direct. It tries to cut off any player that has been used for mass piracy. "When a pirate makes a copy of a film encoded as SPDC, the output file is cryptographically bound to a set of player decryption keys. So it is easy when looking at a pirated work on a peer to peer network, or any copies found on copied DVDs, to identify which player made those copies," said Laren "When the content owner sends out any further content it can contain on it a revocation of just the player that was used to make a pirated copy." "We picture a message popping up on a screen saying something like 'Disney movies won't play on your player any more please call this number for further information.' Or perhaps 'To fix this please call Disney with your credit card,' something like that anyway. "We know that pirates can make copies by tapping the MPEG stream with modified players, or by making a bit for bit copy of the disk, or by using an analog attack (catching the film stream on the way to the TV over aerial cabling and re-digitizing it). But using this cryptographical binding we have forensic marking visible on the copy." The neat thing about this process is that if someone makes copies for their own use, that can be enabled. Private individuals could be allowed to make copies for other players, even for their friends, and that's no problem. It's only when a pirated copy is discovered coming back to a content owner (presumably watching P2P sites) that a player will get revoked, and that is only effective on content made after that point, with the revocation message in it. When asked Laren said, "No, this is not the same as fingerprinting or watermarking. When you generate a fingerprint you are making each copy that is sold, slightly different and that has some cost implications when stamping disks. Our forensic information is being created by the player's virtual machine at the time it is played (copied) so all the disks can be identical." The virtual machine players create movie outputs that are artistically identical but each one is altered if some minor way. This alteration is just the changing of a few bits of data every few seconds, so every 50 frames or so. And the CR system works such that if ten separate players are used in collusion in a copying process, taking samples of frames from each, it will not only identify one of the players, but all of them and they can be revoked from all future content. "The big problem for studios is piracy based on film copies that have no digital identifiers. Because they can be sent around the internet with no chance of catching the original copier and then you have to go after the P2P user." "The problem now is that everything in this market has accelerated. There are time constraints in that all the studios want to move to better protection as soon as the new disk formats come out and that is set for the end of next year. This means that AACS has to get its skates on if the players for this market are not to be launched ahead of its choice of security system. By that time, if the CR system, or any other system, is to be used, the virtual machine players need to be integrated onto the two format in time for testing and studio acceptance to take place prior to the end of 2005. CR has in fact dropped any attempt to have its actual encryption technologies used in this process. The disk formats will accept RSA or AES 128 bit encryption or both, but CR says this doesn't matter. "The cryptographic portion of this is pretty easy to solve and any cryptographer that knows what he is doing can do a good job of that. So we have withdrawn from that part of the spec and we're just putting forward the binding process to our virtual machine," said Laren. The virtual machine is based on a stripped down DLX processor. CR has taken out the floating point arithmetic and we've made a few changes for the sake of extra security. The DLX is a 32-bit pipelined embedded RISC CPU architecture that has come out of academia and was originally designed for teaching, but is not too unlike the ARM or any other RISC device. It can be built in hardware, expressed in a hardware language like the Verilog Hardware Description Language and CR has a reference implementation in the C programming language. As for the business model of CR, it plans to charge no royalty to the consumer electronics manufacturers, and adheres to the principle of charging the businesses whose security problems it solves, in this case the studios. So it plans to charge, perhaps as little as a couple of cents, for each HD disk that is pressed using the technology. What if only one of the two disk formats agrees to install the player in their HD DVD players? "Well if one format gets its security broken, then that is a basis for suppliers to switch to the other format isn't it," says Laren in a clearly rehearsed sales pitch. But in the end, Self Protecting Digital Content remain only a speed bump. For real pirates, buying a new player every time they get a set of keys revoked is just an inconvenience, but for someone that is casually taking content and placing it on the internet, the loss of function on their personal devices will certainly reduce the activity to only the seriously committed. "We realize that all we are doing is enabling the game that goes on between the pirate and the content owners. We see revocation of keys through this system as taking last mover advantage away from the pirates, and giving it back to the content owners," concludes Laren. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DaimlerChrysler's Chief Has Armored Mercedes Stolen
by R.A. Hettinga 15 Dec '04

15 Dec '04

<http://www.bloomberg.com/apps/news?pid=10000085&sid=aRaEXeRubjHc> Bloomberg DaimlerChrysler's Chief Has Armored Mercedes Stolen Nov. 22 (Bloomberg) -- DaimlerChrysler AG Chief Executive Officer Juergen Schrempp had his S600 Mercedes-Benz armored limousine stolen while it was parked on a street in Stuttgart, the German city in which the carmaker is based. The black company car, which is worth about 800,000 euros ($1 million), disappeared on the night of Oct. 26, police spokesman Klaus-Peter Arand said in a telephone interview. The limousine, which sports a 12-cylinder engine and is equipped with a broadcasting device to help retrieve the car, hasn't yet been found, the police said. Schrempp, 60, has been CEO of DaimlerChrysler since 1995. Hartmut Schick, a spokesman for the world's fifth-largest carmaker, confirmed the theft without giving details. The S600 is the top limousine with the Mercedes brand. The cheapest version of the car costs 129,398 euros, according to the company's Web site. The stolen vehicle had bullet-proof windows, ``finger-thick'' steel plates as part of its chassis as well as tires designed to keep it running even when flat, Bild-Zeitung reported today. The car was probably stolen by the ``Russian mafia,'' the German newspaper said, citing an unidentified investigator. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Safe Personal Computing (was Re: CRYPTO-GRAM, December 15, 2004)
by R.A. Hettinga 15 Dec '04

15 Dec '04

At 11:41 PM -0600 12/14/04, Bruce Schneier wrote: > Safe Personal Computing > > ><http://www.schneier.com/blog/archives/2004/12/safe_personal_c.html> > >I am regularly asked what average Internet users can do to ensure their >security. My first answer is usually, "Nothing--you're screwed." > >But that's not true, and the reality is more complicated. You're >screwed if you do nothing to protect yourself, but there are many >things you can do to increase your security on the Internet. > >Two years ago, I published a list of PC security recommendations. The >idea was to give home users concrete actions they could take to improve >security. This is an update of that list: a dozen things you can do to >improve your security. > >General: Turn off the computer when you're not using it, especially if >you have an "always on" Internet connection. > >Laptop security: Keep your laptop with you at all times when not at >home; treat it as you would a wallet or purse. Regularly purge >unneeded data files from your laptop. The same goes for PDAs. People >tend to store more personal data--including passwords and PINs--on PDAs >than they do on laptops. > >Backups: Back up regularly. Back up to disk, tape or CD-ROM. There's >a lot you can't defend against; a recent backup will at least let you >recover from an attack. Store at least one set of backups off-site (a >safe-deposit box is a good place) and at least one set >on-site. Remember to destroy old backups. The best way to destroy >CD-Rs is to microwave them on high for five seconds. You can also >break them in half or run them through better shredders. > >Operating systems: If possible, don't use Microsoft Windows. Buy a >Macintosh or use Linux. If you must use Windows, set up Automatic >Update so that you automatically receive security patches. And delete >the files "command.com" and "cmd.exe." > >Applications: Limit the number of applications on your machine. If >you don't need it, don't install it. If you no longer need it, >uninstall it. Look into one of the free office suites as an >alternative to Microsoft Office. Regularly check for updates to the >applications you use and install them. Keeping your applications >patched is important, but don't lose sleep over it. > >Browsing: Don't use Microsoft Internet Explorer, period. Limit use of >cookies and applets to those few sites that provide services you >need. Set your browser to regularly delete cookies. Don't assume a >Web site is what it claims to be, unless you've typed in the URL >yourself. Make sure the address bar shows the exact address, not a >near-miss. > >Web sites: Secure Sockets Layer (SSL) encryption does not provide any >assurance that the vendor is trustworthy or that its database of >customer information is secure. > >Think before you do business with a Web site. Limit the financial and >personal data you send to Web sites--don't give out information unless >you see a value to you. If you don't want to give out personal >information, lie. Opt out of marketing notices. If the Web site gives >you the option of not storing your information for later use, take >it. Use a credit card for online purchases, not a debit card. > >Passwords: You can't memorize good enough passwords any more, so don't >bother. For high-security Web sites such as banks, create long random >passwords and write them down. Guard them as you would your cash: >i.e., store them in your wallet, etc. > >Never reuse a password for something you care about. (It's fine to >have a single password for low-security sites, such as for newspaper >archive access.) Assume that all PINs can be easily broken and plan >accordingly. > >Never type a password you care about, such as for a bank account, into >a non-SSL encrypted page. If your bank makes it possible to do that, >complain to them. When they tell you that it is OK, don't believe >them; they're wrong. > >E-mail: Turn off HTML e-mail. Don't automatically assume that any >e-mail is from the "From" address. > >Delete spam without reading it. Don't open messages with file >attachments, unless you know what they contain; immediately delete >them. Don't open cartoons, videos and similar "good for a laugh" files >forwarded by your well-meaning friends; again, immediately delete them. > >Never click links in e-mail unless you're sure about the e-mail; copy >and paste the link into your browser instead. Don't use Outlook or >Outlook Express. If you must use Microsoft Office, enable macro virus >protection; in Office 2000, turn the security level to "high" and don't >trust any received files unless you have to. If you're using Windows, >turn off the "hide file extensions for known file types" option; it >lets Trojan horses masquerade as other types of files. Uninstall the >Windows Scripting Host if you can get along without it. If you can't, >at least change your file associations, so that script files aren't >automatically sent to the Scripting Host if you double-click them. > >Antivirus and anti-spyware software: Use it--either a combined program >or two separate programs. Download and install the updates, at least >weekly and whenever you read about a new virus in the news. Some >antivirus products automatically check for updates. Enable that >feature and set it to "daily." > >Firewall: Spend $50 for a Network Address Translator firewall device; >it's likely to be good enough in default mode. On your laptop, use >personal firewall software. If you can, hide your IP address. There's >no reason to allow any incoming connections from anybody. > >Encryption: Install an e-mail and file encryptor (like >PGP). Encrypting all your e-mail or your entire hard drive is >unrealistic, but some mail is too sensitive to send in the >clear. Similarly, some files on your hard drive are too sensitive to >leave unencrypted. > >None of the measures I've described are foolproof. If the secret >police wants to target your data or your communications, no >countermeasure on this list will stop them. But these precautions are >all good network-hygiene measures, and they'll make you a more >difficult target than the computer next door. And even if you only >follow a few basic measures, you're unlikely to have any problems. > >I'm stuck using Microsoft Windows and Office, but I use Opera for Web >browsing and Eudora for e-mail. I use Windows Update to automatically >get patches and install other patches when I hear about them. My >antivirus software updates itself regularly. I keep my computer >relatively clean and delete applications that I don't need. I'm >diligent about backing up my data and about storing data files that are >no longer needed offline. > >I'm suspicious to the point of near-paranoia about e-mail attachments >and Web sites. I delete cookies and spyware. I watch URLs to make >sure I know where I am, and I don't trust unsolicited e-mails. I don't >care about low-security passwords, but try to have good passwords for >accounts that involve money. I still don't do Internet banking. I >have my firewall set to deny all incoming connections. And I turn my >computer off when I'm not using it. > >That's basically it. Really, it's not that hard. The hardest part is >developing an intuition about e-mail and Web sites. But that just >takes experience. > >Others have disagreed with these recommendations: ><http://www.getluky.net/archives/000145.html> ><http://www.berylliumsphere.com/security_mentor/2004/12/heres-another-re >ally-good-twelve.html> or <http://makeashorterlink.com/?Z3772560A> > >My original essay on the topic: ><http://www.schneier.com/crypto-gram-0105.html#8> > >This essay previously appeared on CNet: ><http://news.com.com/Who+says+safe+computing+must+remain+a+pipe+dream/20 >10-1071_3-5482340.html> or <http://makeashorterlink.com/?V6872560A> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Done the crime, now it's Mitnick's time
by InfoSec News 15 Dec '04

15 Dec '04

http://www.theage.com.au/news/Next/Done-the-crime-now-its-Mitnicks-time/200… By Patrick Gray December 14, 2004 Next After a five-month delay, the Department of Immigration has granted the world's most notorious convicted cyber-criminal, Kevin Mitnick, a visa to travel to Australia next year to consult to local companies, accept speaking engagements and promote his new book, scheduled for release in March. It will be Mitnick's first visit to Australia and one of his few trips outside the US and Europe. Mitnick spent more than five years in jail for his exploits, which included hacking into Motorola, Novell, Fujitsu, Sun Microsystems and Nokia to steal software code. Since his release in 2000, he has worked as a security consultant and written two books, The Art of Deception [1] and The Art of Intrusion [2]. Mitnick will fly to Melbourne on March 2 to deliver a keynote speech to an as yet unnamed company. He will fly back to the US the following week to start a book tour, returning to Australia in April to conduct a workshop. Mitnick is best known for his uncanny ability to trick employees into revealing sensitive information, a technique called "social engineering". He cites the theft of two customs computers from Sydney International Airport by three men in August last year as one example of a social engineering attack in Australia. "A lot of companies in Australia are vulnerable," Mitnick says. "That was a pure social engineering attack. We all know they weren't after the hardware, they were after the data." Both of Mitnick's books are about security but many people will be more eager to read the one he plans to start writing on January 21, 2007, when a court order that stops him from profiting from his crimes expires. "I'm definitely doing an autobiography," he says. "It's going to focus on the adventure, the things I did when I was a fugitive, how I lived my life and what was going through my head, the close calls nobody knows about. It will be the Catch Me If You Can of cyberspace." Catch Me If You Can [3] was an autobiography written in 1980 by Frank Abagnale jnr, a con man who passed himself off as a Pan Am pilot while forging $US2.5 million in fake cheques. There have been books written about Mitnick's exploits, most famously Takedown, written by New York Times journalist John Markoff and Tsutomo Shimomura, one of Mitnick's victims, which was made into a movie. But Mitnick says the real story hasn't been told. He has been portrayed as the "Osama bin-Mitnick of the internet", he says, and he wants to set the record straight. Mitnick launched a legal action against the producers of the Takedown movie, which was settled out of court. Although Mitnick spent two years on the run from the FBI in the US living under assumed names, he doesn't expect law enforcement to take much interest in his travels these days. "The only time they call me is when they need my help," Mitnick says. "They don't contact me because they're suspicious I'm doing anything wrong." Mitnick has just finished a vulnerability assessment of a US credit union. Much of his work involves technical testing and doesn't rely on his mastery of social engineering. "I'm doing vulnerability penetration tests, I'm going into companies and hardening their systems and network," he says. "It's all technical, no social engineering." A penetration test is work well suited to Mitnick's talents. Similar to the fictional hackers in the 1992 movie, Sneakers, for a fee, he breaks into companies' networks, submitting a report detailing security weaknesses and vulnerabilities. Before his release, Mitnick had never been out of the US, with the exception of Canada and Mexico. As much as he enjoys seeing the world, Mitnick confesses he is afraid of flying. "I hate to fly, man, I hate it. I have to get some sleeping pills to knock me out." [1] http://www.amazon.com/exec/obidos/ASIN/076454280X/c4iorg [2] http://www.amazon.com/exec/obidos/ASIN/0764569597/c4iorg [3] http://www.amazon.com/exec/obidos/ASIN/0767905385/c4iorg _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Done the crime, now it's Mitnick's time
by InfoSec News 15 Dec '04

15 Dec '04

http://www.theage.com.au/news/Next/Done-the-crime-now-its-Mitnicks-time/200… By Patrick Gray December 14, 2004 Next After a five-month delay, the Department of Immigration has granted the world's most notorious convicted cyber-criminal, Kevin Mitnick, a visa to travel to Australia next year to consult to local companies, accept speaking engagements and promote his new book, scheduled for release in March. It will be Mitnick's first visit to Australia and one of his few trips outside the US and Europe. Mitnick spent more than five years in jail for his exploits, which included hacking into Motorola, Novell, Fujitsu, Sun Microsystems and Nokia to steal software code. Since his release in 2000, he has worked as a security consultant and written two books, The Art of Deception [1] and The Art of Intrusion [2]. Mitnick will fly to Melbourne on March 2 to deliver a keynote speech to an as yet unnamed company. He will fly back to the US the following week to start a book tour, returning to Australia in April to conduct a workshop. Mitnick is best known for his uncanny ability to trick employees into revealing sensitive information, a technique called "social engineering". He cites the theft of two customs computers from Sydney International Airport by three men in August last year as one example of a social engineering attack in Australia. "A lot of companies in Australia are vulnerable," Mitnick says. "That was a pure social engineering attack. We all know they weren't after the hardware, they were after the data." Both of Mitnick's books are about security but many people will be more eager to read the one he plans to start writing on January 21, 2007, when a court order that stops him from profiting from his crimes expires. "I'm definitely doing an autobiography," he says. "It's going to focus on the adventure, the things I did when I was a fugitive, how I lived my life and what was going through my head, the close calls nobody knows about. It will be the Catch Me If You Can of cyberspace." Catch Me If You Can [3] was an autobiography written in 1980 by Frank Abagnale jnr, a con man who passed himself off as a Pan Am pilot while forging $US2.5 million in fake cheques. There have been books written about Mitnick's exploits, most famously Takedown, written by New York Times journalist John Markoff and Tsutomo Shimomura, one of Mitnick's victims, which was made into a movie. But Mitnick says the real story hasn't been told. He has been portrayed as the "Osama bin-Mitnick of the internet", he says, and he wants to set the record straight. Mitnick launched a legal action against the producers of the Takedown movie, which was settled out of court. Although Mitnick spent two years on the run from the FBI in the US living under assumed names, he doesn't expect law enforcement to take much interest in his travels these days. "The only time they call me is when they need my help," Mitnick says. "They don't contact me because they're suspicious I'm doing anything wrong." Mitnick has just finished a vulnerability assessment of a US credit union. Much of his work involves technical testing and doesn't rely on his mastery of social engineering. "I'm doing vulnerability penetration tests, I'm going into companies and hardening their systems and network," he says. "It's all technical, no social engineering." A penetration test is work well suited to Mitnick's talents. Similar to the fictional hackers in the 1992 movie, Sneakers, for a fee, he breaks into companies' networks, submitting a report detailing security weaknesses and vulnerabilities. Before his release, Mitnick had never been out of the US, with the exception of Canada and Mexico. As much as he enjoys seeing the world, Mitnick confesses he is afraid of flying. "I hate to fly, man, I hate it. I have to get some sleeping pills to knock me out." [1] http://www.amazon.com/exec/obidos/ASIN/076454280X/c4iorg [2] http://www.amazon.com/exec/obidos/ASIN/0764569597/c4iorg [3] http://www.amazon.com/exec/obidos/ASIN/0767905385/c4iorg _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[i2p] Threat model (fwd from tkaitchuck@comcast.net)
by Eugen Leitl 15 Dec '04

15 Dec '04

----- Forwarded message from Tom Kaitchuck <tkaitchuck(a)comcast.net> -----

1 0

Hollywood fights illegal downloads by targeting servers
by R.A. Hettinga 14 Dec '04

14 Dec '04

<http://www.reuters.co.uk/printerFriendlyPopup.jhtml?type=entertainmentNews&…> Reuters News Article Hollywood fights illegal downloads by targeting servers Tue Dec 14, 2004 08:29 AM ET By Jesse Hiestand LOS ANGELES (Hollywood Reporter) - Hollywood's major studios intend to escalate their battle against illegal movie downloading by targeting the popular BitTorrent network and those who operate its servers, the movie industry's lobbying arm is set to announce. The civil suits against server operators marks the next step in the Motion Picture Assn. of America's (MPAA) anti-piracy campaign, which started last month with lawsuits against individuals who shared movies on peer-to-peer services. In addition to civil lawsuits filed in the United States, a news conference at the MPAA's offices in Washington on Tuesday also will detail how international law enforcement has aided these anti-piracy efforts. Further details of the event were not available. MPAA president and CEO Dan Glickman is set to make the announcement along with Travis Kalanick, CEO of Red Swoosh, which develops private P2P networks, and Mark Ishikawa, CEO of BayTSP, which offers file-branding and -tracking applications. BitTorrent can rapidly transfer large files among many people, leading to interest among legitimate users who recognize the technology's efficiency and speed. While it is among the fastest-growing P2P networks, BitTorrent is different from its predecessors in several respects. Unlike other networks, where users can search for a file, BitTorrent users must go to a Web site to get a "torrent file" and connect to a server to find other users who have the file. The network relies on these "tracker" servers to manage users' downloads by knowing who has the file and connecting users for uploading and downloading. Because downloaders swap portions of a file with one another, the file-trading functions like a collective swarm rather than a series of individual connections to a single server. Sources say the MPAA is not necessarily going after BitTorrent's developer, Bram Cohen, only the server operators. The major motion picture studios filed their first round of civil lawsuits in mid-November, initially targeting about 200 people who allegedly made movies available on P2P services. The record industry, through the RIAA, pioneered this practice and has now filed about 7,000 civil cases, most of which have been settled for a few thousand dollars. The MPAA estimates that the studios lose about $3.5 billion annually to physical piracy like bootlegged DVDs but does not have a ready figure for Internet-related losses. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0