December 2004 - cypherpunks-legacy

[IP] more on The Shadow Internet (fwd from dave@farber.net)
by Eugen Leitl 31 Dec '04

31 Dec '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

[IP] The Shadow Internet (fwd from dave@farber.net)
by Eugen Leitl 31 Dec '04

31 Dec '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Korean Online Banks Will Be Liable for 'Hacking' Damages in 2006
by R.A. Hettinga 31 Dec '04

31 Dec '04

--- begin forwarded text

1 0

Re: [CYBERIA] On-line Purchase Denied
by Greg Broiles 31 Dec '04

31 Dec '04

On Thu, 30 Dec 2004 17:04:45 -0600, Mikus Grinbergs <mikus(a)bga.com> wrote: > For the second time in a month, I've had an on-line purchase > denied. When I ask my credit card company, they say the > refusal did not originate with them. And when I ask the > merchant, they say they have contracted out the credit > verification, and do not know what criteria are being used. > > The only potential explanation that I can think of is that > my e-mail address points to an ALIAS of my ISP. Thus if > the credit verification process attempts to reverse-lookup > the (DYNAMIC!!) IP-address I used in requesting the purchase, > the domain-name returned for that IP-address would not match > the e-mail domain-name I told the merchant. [But that *is* > my correct e-mail address; I've used it for many years in > making many many on-line purchases.] > > Being told in effect "you're not good enough to buy from us" > seems a strange approach towards gaining new customers. But from the merchant's perspective, it's very difficult to know whether or not you're a customer, or a thief. Admittedly, that's not a very friendly posture to adopt relative to new business. However, if you're trying to buy something physical that the merchant is supposed to ship, a failed transaction is much worse than no transaction. If a bad guy orders something with a bad credit card number, and it gets shipped, the merchant is out-of-pocket for their wholesale cost for the item, order processing costs, shipping costs, a chargeback fee from their credit card processor, and a bunch of administrative time spent dealing with the bad order. (And, if you want to be really picky, they also may have lost the profit they'd have made if they were able to sell the same item to a real customer, if the item is in short supply.) If the order never happens, they haven't lost a thing - and, worst case, return the unsold merchanidse to their supplier, or sell it at a reduced price. That's a lot better than the outcome described above. The credit card payment system is set up so that the selling merchant loses if the transaction fails. (It is theoretically possible for them to shift the risk onto the bank(s) involved - but the rules to be followed are complicated enough, and burdensome enough, that it's easier to conceptualize them as "merchant loses".) Thus, merchants become relatively conservative about the transactions they'll accept - they might refuse a transaction if the source IP for the transaction doesn't seem reasonable relative to the shipping address, if the shipping address doesn't match the card's billing address, if the buyer can't provide the three-digit verification code printed on the back of the credit card, or if the shipping address is to a country known for being the source of a lot of fraudulent activity. This makes life difficult for honest people in those countries to order things over the Internet - but the current setup also makes life difficult for honest people to sell things without getting screwed. So far, there's no easy answer, either. You could look at transaction systems where the risk of failure is allocated to the buyer, not the merchant, such as E-gold; or systems such as Paypal, where there's an intermediary who attempts to police everyone's behavior to make transactions work reasonably. (although those attempts are imperfect, like most things in this world.) This difficulty is an unavoidable consequence of legislation intended to, ironically, protect consumers - primarily the body of federal legislation controlling consumer credit and consumer debt collection, together with the FTC's regulations implementing the same. If a merchant believes that the cost of failure multiplied by the likelihood of failure is greater than the expected profit on the transaction, they'll decline to enter into the transaction. If you change the rules so that consumers and vendors can contract around the rules allocating risk, then riskier transactions are economically feasible, but bad things will happen, and sometimes they will happen to innocent consumers who will complain to their legislators .. and so on. -- Greg Broiles, JD, EA gbroiles(a)gmail.com (Lists only. Not for confidential communications.) Law Office of Gregory A. Broiles San Jose, CA ********************************************************************** For Listserv Instructions, see http://www.lawlists.net/cyberia Off-Topic threads: http://www.lawlists.net/mailman/listinfo/cyberia-ot Need more help? Send mail to: Cyberia-L-Request(a)listserv.aol.com ********************************************************************** --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [CYBERIA] On-line Purchase Denied
by Greg Broiles 31 Dec '04

31 Dec '04

On Thu, 30 Dec 2004 17:04:45 -0600, Mikus Grinbergs <mikus(a)bga.com> wrote: > For the second time in a month, I've had an on-line purchase > denied. When I ask my credit card company, they say the > refusal did not originate with them. And when I ask the > merchant, they say they have contracted out the credit > verification, and do not know what criteria are being used. > > The only potential explanation that I can think of is that > my e-mail address points to an ALIAS of my ISP. Thus if > the credit verification process attempts to reverse-lookup > the (DYNAMIC!!) IP-address I used in requesting the purchase, > the domain-name returned for that IP-address would not match > the e-mail domain-name I told the merchant. [But that *is* > my correct e-mail address; I've used it for many years in > making many many on-line purchases.] > > Being told in effect "you're not good enough to buy from us" > seems a strange approach towards gaining new customers. But from the merchant's perspective, it's very difficult to know whether or not you're a customer, or a thief. Admittedly, that's not a very friendly posture to adopt relative to new business. However, if you're trying to buy something physical that the merchant is supposed to ship, a failed transaction is much worse than no transaction. If a bad guy orders something with a bad credit card number, and it gets shipped, the merchant is out-of-pocket for their wholesale cost for the item, order processing costs, shipping costs, a chargeback fee from their credit card processor, and a bunch of administrative time spent dealing with the bad order. (And, if you want to be really picky, they also may have lost the profit they'd have made if they were able to sell the same item to a real customer, if the item is in short supply.) If the order never happens, they haven't lost a thing - and, worst case, return the unsold merchanidse to their supplier, or sell it at a reduced price. That's a lot better than the outcome described above. The credit card payment system is set up so that the selling merchant loses if the transaction fails. (It is theoretically possible for them to shift the risk onto the bank(s) involved - but the rules to be followed are complicated enough, and burdensome enough, that it's easier to conceptualize them as "merchant loses".) Thus, merchants become relatively conservative about the transactions they'll accept - they might refuse a transaction if the source IP for the transaction doesn't seem reasonable relative to the shipping address, if the shipping address doesn't match the card's billing address, if the buyer can't provide the three-digit verification code printed on the back of the credit card, or if the shipping address is to a country known for being the source of a lot of fraudulent activity. This makes life difficult for honest people in those countries to order things over the Internet - but the current setup also makes life difficult for honest people to sell things without getting screwed. So far, there's no easy answer, either. You could look at transaction systems where the risk of failure is allocated to the buyer, not the merchant, such as E-gold; or systems such as Paypal, where there's an intermediary who attempts to police everyone's behavior to make transactions work reasonably. (although those attempts are imperfect, like most things in this world.) This difficulty is an unavoidable consequence of legislation intended to, ironically, protect consumers - primarily the body of federal legislation controlling consumer credit and consumer debt collection, together with the FTC's regulations implementing the same. If a merchant believes that the cost of failure multiplied by the likelihood of failure is greater than the expected profit on the transaction, they'll decline to enter into the transaction. If you change the rules so that consumers and vendors can contract around the rules allocating risk, then riskier transactions are economically feasible, but bad things will happen, and sometimes they will happen to innocent consumers who will complain to their legislators .. and so on. -- Greg Broiles, JD, EA gbroiles(a)gmail.com (Lists only. Not for confidential communications.) Law Office of Gregory A. Broiles San Jose, CA ********************************************************************** For Listserv Instructions, see http://www.lawlists.net/cyberia Off-Topic threads: http://www.lawlists.net/mailman/listinfo/cyberia-ot Need more help? Send mail to: Cyberia-L-Request(a)listserv.aol.com ********************************************************************** --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] Cell phones for eavesdropping
by Major Variola (ret) 30 Dec '04

30 Dec '04

>From: Gadi Evron <ge(a)linuxbox.org> >Subject: Cell phones for eavesdropping - finally some public "chatter" Of course, the low-budget govt snoops go for the basestations and landline links. The pending cell phone virus which calls 911 should be a real hoot. I wonder if cell virii can carry a voice payload which they can inject as well. Or do we have to wait a few (viral) generations for that?

1 0

Re: [CYBERIA] On-line Purchase Denied
by R.A. Hettinga 30 Dec '04

30 Dec '04

--- begin forwarded text

1 0

Dept Homeland Security Research Conference in Boston, April 27-28
by Bill Stewart 30 Dec '04

30 Dec '04

Not sure what mailing list this came from, but the DHS is running a shindig in Boston in April, if anybody wants to drop by. I've de-MIME-ified it, so it may be a bit harder to read. From: DHS Homeland Security Conference [mailto:anzentech@app.topica.com] Sent: Wednesday, December 29, 2004 5:45 PM Subject: Conference for Public/Private R&D Partnerships in Homeland Security, CFP Dear Colleague, You are invited to participate in this inaugural, must-attend, national event, sponsored by the U.S. Department of Homeland Security, Science and Technology Directorate, scheduled for April 27 & 28, 2005 in Boston, to encourage public-private partnering among scientists and engineers from government, national laboratories, universities, research institutes, and private sector firms investing in R&D. Private sector and university-based scientists can benefit from the technologies and technical approaches developed and deployed by the national and DHS labs. The laboratories in turn can explore leveraging opportunities with leading private sector and university-based research programs. Please take a moment to consider submitting a paper presenting your research at this conference. If you cannot submit a paper, attend and learn what others are doing and how you can work with them. We are also seeking conference cosponsors and exhibitors from both public and private sector organizations. Visit the conference web site, www.homelandsecurityresearchconference.org <http://anzentech.c.topica.com/maac1jvabcT5eaIcCidcadIdN1/> , for more details often. It is constantly being updated. Working Together: Conference on Public/Private R&D Partnerships in Homeland Security Sponsored by the U.S. Department of Homeland Security, Science & Technology Directorate April 27 & 28, 2005 The Seaport Hotel and World Trade Center Boston, Massachusetts, USA Call for Technical Papers The First Annual Working Together: Conference on Public/Private Research & Development (R&D) Partnerships in Homeland Security This two-day Conference will focus on state-of-the-art science and technology to anticipate, prevent, respond to, and recover from high-consequence chemical, biological, radiological, nuclear, explosives and cyber terrorist threats. The conference will also address protection of the nation's critical infrastructure, and the harnessing of science and intelligence to reduce threat and risk. The objectives of this inaugural event are to encourage public-private partnering among scientists and engineers from government, national laboratories, universities and research institutes, and private sector firms investing in R&D, to address the collective science and technology research goals of the U.S. homeland security community. Private sector and university-based scientists can benefit from the technologies and technical approaches developed and deployed by the national and DHS labs. The laboratories in turn can explore leveraging opportunities with leading private sector and university-based research programs. Through plenary and breakout sessions, posters and a companion Exhibition Conference Participants will: 7 learn about DHS awareness, countermeasures and response and recovery goals; 7 address the most pressing technical challenges; 7 identify the most critical knowledge gaps; 7 be introduced to the core capabilities of national and DHS laboratories, and the Departments university-based homeland security centers; and Background DHS is committed to science and technology leadership, and the creation of an enduring national capability for homeland security. Toward this end, the DHS S&T Directorate supports and recognizes technical excellence in research, development, testing and evaluation (RDT&E) of homeland security technologies; encourages collaborations and partnerships among RDT&E performers across the homeland security science and technology complex; actively disseminates knowledge generated through the execution of RDT&E programs and university-based homeland security centers; and to the greatest extent practical, enhances visibility and recognition of scientists and engineers dedicated to homeland security missions. Technical Topics We are seeking papers on the following topics: 7 Threat Characterization for: Chemical, Biological, Radiological / Nuclear, Conventional Explosives (CBRNE) 7 Threat and Vulnerability Assessment including: Knowledge Discovery (Semantic Graphs), Technology-based Emerging Threats (e.g., terrorist exploitation of advances in nanotechnology and biotechnology), Advanced Risk Modeling, Simulation and Analysis for Decision Support, Modeling and Simulation (Cognition and Behavior), Discrete Sciences, Visual Analytics 7 Sensors including: Performance Improvement, Next-Generation Designs, and Architecture for Devices and Systems 7 Forensics and Attribution for Chemical and Biological Events 7 Chemical Countermeasures Including: Detection (TICs and TIMs), Surveillance/Detection (Low Volatility/Chemical Warfare Agents) 7 Biological Countermeasures including: Agricultural Security, Surveillance (Situational Awareness) 7 Radiological/Nuclear Countermeasures including: Passive and Active Detection 7 Explosives Detection including: Bulk and Trace Detection and Nanosensors 7 Methods to Disarm/Defeat Conventional Explosives 7 Critical Infrastructure Protection and Cyber Security including: Addressing Insider Threat, Large Scale Situational Awareness 7 Post-Event Recovery and Restoration from events involving the use of chemical and biological agents and nuclear and radioactive materials (e.g., improvised nuclear devices and radiological dispersion devices). Information and Important Dates Abstracts should be submitted in MS Word and limited to a maximum of 250 words. On the same page, the author(s) title, name, address, phone, fax, email and organization affiliation must be submitted. In addition, a maximum of 100-word biography of the presenting author is required on a separate page. Electronic versions of abstracts and papers should be submitted via the conference website. Detailed instructions about the electronic submission process will be published on the website. All electronic submissions will be acknowledged via email. Abstract deadline: February 7, 2005 Speaker Notification: March 1, 2005 Final Paper Deadline: At the Conference For more information on the First Annual National Homeland Security R&D Conference, please refer to website: www.homelandsecurityresearchconference.org Call for Sponsors and Exhibitors We are seeking conference cosponsors and exhibitors from public and private sector organizations. For more information on sponsorship opportunities, please email: dhsconferencesponsorships(a)anzentechpartners.com <mailto:dhsconferencesponsorships@anzentechpartners.com> . For more information on exhibit opportunities, please email dhsconferenceexhibits(a)anzentechpartners.com <mailto:dhsconferenceexhibits@anzentechpartners.com> . Call for Preliminary Registration If you are interested in attending this conference, please email us at dhsconference(a)anzentechpartners.com <mailto:dhsconference@anzentechpartners.com> . To make sure you receive our notices, please configure your spam filter to accept this email address. Conference Organizer DHS S&T - The Department of Homeland Securitys Science and Technology Directorate is the primary research and development arm of the Department. It provides Federal, state, and local officials with the technology and capabilities to protect the homeland. You are subscribed as billstewart(a)att.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ---- Bill Stewart bill.stewart(a)pobox.com

1 0

eBay Dumps Passport, Microsoft Calls It Quits
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.techweb.com/article/printableArticle.jhtml;jsessionid=IUVVYXUECE…> eBay Dumps Passport, Microsoft Calls It Quits By TechWeb News December 30, 2004 (12:51 PM EST) URL: http://www.techweb.com/wire/ebiz/56800077 Another Online auction site eBay announced Wednesday that it will soon drop support for Microsoft's Passport for log-in to the site and discontinuing alerts sent via Microsoft's .Net alerts. Microsoft responded by saying that it will stop marketing Passport to sites outside its own stable. As of late January, eBay will no longer display the Passport button on sign-in pages nor allow users to log in using their Passport accounts. Instead, members must log-in directly through eBay. Likewise, eBay's dumping .Net alerts, which means that eBay customers who want to receive alerts -- for such things as auction closings, outbids, and auction wins -- will have to make other arrangements. The free-of-charge eBay Toolbar, for instance, can be used to set up alerts going to the desktop, while alerts to phones, PDAs, or pagers can be created from the user's My eBay page. eBay was one of the first to jump on the Passport bandwagon in 2001, but is only the latest site to leap off. Job search site Monster.com, for instance, dropped Passport in October. Microsoft has decided to stop marketing its sign-on service to other Web sites, the Los Angeles Times confirmed Thursday. The pull-back, which had been long predicted by various analysts, follows a stormy life for Passport, which among other things, suffered a pair of security breakdowns in the summer of 2003 that could have led to hackers stealing users' IDs. Microsoft also pulled its online directory of sites using Passport -- perhaps because the list would have been depressingly short -- stating in the online notice that "We have discontinued our Site Directory, but you'll know when you can use your Passport to make sign-in easier. Just look for the .NET Passport Sign In button!" Passport will continue to be the sign-on service for various Microsoft properties, including the Hotmail e-mail service and MSN.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

The story of Aldrich Ames and Robert Hanssen--from the KGB's point of view.
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.opinionjournal.com/la/?id=110006088> OpinionJournal WSJ Online BOOKSHELF The Man Who Stole the Secrets The story of Aldrich Ames and Robert Hanssen--from the KGB's point of view. BY EDWARD JAY EPSTEIN Thursday, December 30, 2004 12:01 a.m. EST Recently a number of former CIA officers received an invitation from the Spy Museum in Washington to attend a luncheon for former KGB Col. Victor Cherkashin. The event, as the invitation said, would afford "a once-in-a-lifetime opportunity to dine and dish with an extraordinary spymaster." In the heyday of the Cold War, such an offer, delivered with slightly more discretion, might have been the prelude to a KGB recruitment operation. Now it's merely the notice for a book party celebrating yet another memoir by a former KGB officer recounting how the KGB duped the CIA. In this case, there is a great deal to tell. Victor Cherkashin served in the KGB from 1952, when Stalin was still in power, until the Soviet Union disintegrated in 1991. During most of that time his mission was to organize KGB operations aimed at undermining the integrity, confidence and morale of the CIA. He seems to have been good at his job. His big opportunity came when he was the deputy KGB chief at the Soviet Embassy in Washington between 1979 and 1985. Those years were the height of a ferocious spy war within the Cold War. In "Spy Handler," Mr. Cherkashin describes in detail how he helped convert two American counterintelligence officers--one well-placed in the CIA's Soviet Russia Division, the other in the FBI--into moles. Their names are notorious now, but over the course of a decade Aldrich Ames and Robert Hanssen operated with anonymous stealth, compromising most of the CIA's and FBI's espionage efforts in the Soviet Union. But that wasn't the end of Mr. Cherkashin's glory. Returning to Moscow, he helped run "dangle" operations in which KGB-controlled diplomats feigned a willingness to be recruited by their American counterparts, only to hand over disinformation when they were finally "recruited." Thus when the CIA came around to investigating why its agents were being compromised in Russia, the KGB sent the CIA a disinformation agent, for example, to paint false tracks away from its moles. This agent--"Mr. X"--offered to betray the Soviet Union for $5,000. When the CIA snapped up the bait, Mr. X pointed it to its own secret communication center in Warrenton, Va., falsely claiming that the KGB was electronically intercepting data from its computers. The purpose, of course, was to divert the agency away from the mole, who continued betraying CIA secrets for eight more years. Told from the KGB's vantage point, Mr. Cherkashin's story provides a gripping account of its successes in the spy war. He shows Mr. Hanssen to have been an easily managed and highly productive "penetration" who operated via the unusual tradecraft of dead drops, leaving material at designated locations where it could be transferred without spy and handler ever meeting. (Indeed, the KGB never knew Mr. Hanssen's identity.) Mr. Ames, for his part, was a more complex case, since he had come under suspicion and the KGB had to concern itself with throwing the CIA off his trail. That America's counterespionage apparatus allowed both men to operate as long as they did is a testament to its complacency as much as to the KGB's cleverness. And indeed, Mr. Cherkashin skillfully torments his former adversary, the CIA, by attributing a large part of the KGB's success to the incompetence of the CIA leadership, or its madness. He asserts, in particular, that the CIA had been "all but paralyzed" by the "paranoia" of James Jesus Angleton, the CIA's longtime counterintelligence chief, who suspected that the KGB had planted a mole in the CIA's Soviet Russia division. Mr. Cherkashin is right that Mr. Angleton's concern retarded, if not "paralyzed," CIA operations in Russia. After all, if the CIA was indeed vulnerable to KGB penetration, as Mr. Angleton believed, it had to assume that its agents in Russia would be compromised and used for disinformation. This suspicion would recommend a certain caution or tentativeness, to say the least. Mr. Cherkashin's taunt about Mr. Angleton's "paranoia" echoed what was said by Mr. Angleton's critics in the CIA, who resented his influence, believing that polygraph tests and other security measures immunized the CIA against such long-term penetration. But of course Mr. Angleton was right, too. On Feb. 21, 1994, Mr. Ames, the CIA officer who had served in the Soviet Russia division, was arrested by the FBI. He confessed that he had been a KGB mole for almost a decade and had provided the KGB with secrets that compromised more than 100 CIA operations in Russia. Mr. Hanssen was caught seven years later. Since Mr. Cherkashin had managed the recruitment of Mr. Ames and helped with that of Mr. Hanssen, his accusation that Mr. Angleton was paranoid for suspecting the possibility of a mole has the exquisite irony of a stalker following his victim in order to tell him that he is not being followed. Mr. Cherkashin adds a further twist by suggesting that Mr. Angleton's "paranoia" made it easier for the KGB to recruit demoralized CIA officers as moles. According to this tortured logic, if the CIA--and its counterintelligence staff--had acted more ostrich-like, by denying the existence of moles in its ranks, the KGB would never have found Aldrich Ames or penetrated the agency in other ways. Mr. Cherkashin, who received the Order of Lenin for his work against the CIA, now runs a security company in Moscow. Because his side lost the Cold War, he is free to travel to Washington to toast his former adversaries (and present them with autographed copies of "Spy Handler"). The unauthorized revealing of KGB secrets is against the law in Vladimir Putin's Russia, and Mr. Cherkashin says that he does not plan to bring out an edition there. But why not? It's hard to imagine that the authorities would find much to object to. Mr. Epstein's "The Big Picture: The New Logic of Money and Power in Hollywood" will be published in February. You can buy "Spy Handler" from the OpinionJournal bookstore. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0