December 2004 - cypherpunks-legacy

Scientists close to network that defies hackers
by R.A. Hettinga 29 Dec '04

29 Dec '04

<http://news.ft.com/cms/s/a0dcf3f0-5874-11d9-9940-00000e2511c8.html> The Financial Times Scientists close to network that defies hackers By Clive Cookson, Science Editor Published: December 28 2004 02:00 | Last updated: December 28 2004 02:00 Scientists have taken what they say is a big step towards an intrinsically secure computer network which banks and other institutions could use to transmit data without risk of hacking. Toshiba Research Europe is one of several laboratories around the world racing to commercialise quantum cryptography, a technology that uses quantum mechanics to generate unbreakable codes. The Cambridge-based company says it has produced the first system robust enough to run uninterruptedly for long periods without human intervention. The Toshiba researchers have tested the system with MCI, the international telecommunications company, and plan next year to carry out trials with financial institutions in London. Secure digital communication uses long prime numbers as keys to encode data at one end and decode at the other. Inquantum cryptography, individual photons - light particles - transmit the secret keys down optical fibres. Each photon carries a digital bit of information, depending on its polarisation. To outwit hackers, the keys are changed many times a second. The extreme delicacy of these quantum bits is both the strength and weakness of quantum cryptography. On the positive side, a hacker cannot eavesdrop on the data transmission without changing it and alerting sender and receiver to the breach of security. But the system is easily disturbed by tiny fluctuations such as temperature changes in the transmission apparatus or movements in the optical fibres. Previous quantum cryptography transmissions have lasted only for minutes and required continual adjustment by experts, says Andrew Shields, head of Toshiba's quantum information group. His laboratory managed to extend the running time to a week's "entirely automated and uninterrupted session". The Cambridge researchers stabilised the system and reduced the error rate by sending a bright "guardian pulse" of light down the fibres immediately after each information-carrying photon. Mr Shields said: "The technology is now sufficiently mature to be used in real-world situations and we are currently discussing applications with interested parties. In the first instance we expect quantum cryptography to be used in companies' private networks - for example, to provide secure traffic in a link between two sites within a metropolitan area." Besides Japanese-owned Toshiba, large electronics companies competing to commercialise quantum cryptography include NEC of Japan and Hewlett-Packard of the US. There are also two start-ups, Magiq Technologies of the US and ID Quantique of Switzerland, with first generation quantum cryptography products on the market, although sales have not been large. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Make Your Computer Programs, Data Invisible to Everyone Except Yourself with MyInvisibleDisk - Infobahn Sdn. Bhd.
by R.A. Hettinga 29 Dec '04

29 Dec '04

<http://www.prleap.com/pr_3046.html> Home | About Us | Contact PR Leap | FAQ | RSS Feeds | Resources | Sign Up | Login / Submit Press Release Recent News | News Releases by Category See More Related Computers News News Released: December 27, 2004 Make Your Computer Programs, Data Invisible to Everyone Except Yourself with MyInvisibleDisk (PRLEAP.COM) MyInvisibleDisk uses an existing free space on your computer drives and create a vault-like container to store all your secret programs and data. It functions similarly to your C-drive on your computer. The real-time encryption technology used is based on the Advanced Encryption Standard with 256-bit keys, which was approved by the National Security Agency (U.S.A.) to protect U.S. government top-level secrets in June 2003. This is considerably stronger than the 112-bit Triple-Data Encryption Standard technology used by local banks and governmental agencies. One of MyInvisibleDisk's unique features is being immune against all hardware and software keystroke recorders which are the scourge of all password-based security systems. By adopting a keyboard-free approach, users can expect unrivaled security with a powerful, elegantly simple click-and-use interface. MyInvisibleDisk also uses proprietary techniques to remove, safely and silently, all possible traces of encryption usage on the user's computer including the computer's page-file without any changes to the computer registry. It also has the unique ability to morph into a harmless-looking application tool in the absence of a genuine key or faced with a tampered key. According to Bruce Schneier, a world-renown author, cryptography and computer security expert, "In the real world, key management is the hardest part of cryptography. Designing secure cryptographic algorithms and protocols isn't easy, but you can rely on a large body of academic research. Keeping the keys secret is much harder". MyInvisibleDisk is unique, being probably the only publicly available product to emphasize on its numerous key-management functionalities. MyInvisibleDisk is currently available in two versions, Professional and Enterprise for computers using Windows XP. The Professional version is suitable for single-computer users; the Enterprise version can protect up to a maximum of eight computers with a single USB device. Companies can purchase different combinations of these two products. MyInvisibleDisk prices starts at the special introductory offer of RM680 (US$179) per computer. Reseller and OEM enquiries are welcomed. About Infobahn Sdn. Bhd. We are an independent, specialty IT software developer with highly-experienced staff. Our key strengths are in designing customized systems involving cryptography and artificial intelligence for financial markets. Contact Information S. K. Wong Infobahn Sdn. Bhd. Email Infobahn Sdn. Bhd. 60 3 58824581 PR Leap disclaims any content found in news releases. Issuers of news releases are solely responsible for the accuracy of their content. ) 2003 Condesa, Inc. All Rights Reserved. Use of our service is governed by our Privacy Policy and Terms of Service. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

In war on terrorism, U.S. drafts shops to be on guard
by Vinnie Moscaritolo 29 Dec '04

29 Dec '04

In war on terrorism, U.S. drafts shops to be on guard By Steve Johnson Knight Ridder Newspapers SAN JOSE, Calif. - It may surprise some people to learn that one of the linchpins in this nation's war on terrorism is the Bin & Barrel Mini Mart in Fremont, Calif. Manager Sonia Cheema certainly was when her dad bought the store in October. Under federal rules still being fine-tuned, she discovered, the Bin & Barrel - like thousands of other businesses - must have a written plan for foiling money-laundering terrorists. It also must have a "compliance officer" to ensure the plan is heeded, train its employees to spot shady transactions and regularly audit its own performance. That's not all. While not widely known, the Bin & Barrel and every other U.S. business must steer clear of people on the government's 192-page list of "specially designated nationals," which has more than 5,000 names and is updated frequently. Otherwise, business people could face huge fines and a long stay in prison. "Oh gosh! Imagine one person coming to cash a check and going through a list," said the 25-year-old Cheema, who has temporarily stopped cashing checks and processing money orders, at least until she understands the federal rules better. "It's going to be a lot of work. ... I don't think it's worth it." Previously, banks were pretty much the only businesses that had to worry about money launderers. But that changed after the terrorist attacks on Sept. 11. On Sept. 24, 2001, President Bush signed an executive order barring business dealings with anyone on the specially designated list, which includes the names and aliases of suspected terrorists, drug kingpins and their associates. Those failing to comply can be fined $10 million and jailed up to 10 years. That was followed a month later by enactment of the USA Patriot Act, which forces "financial institutions"- broadly defined to include everything from liquor stores to pawn shops - to have detailed programs for combating money launderers. Under its enforcement provisions, business operators face potential $500,000 fines and 10-year prison terms. The Patriot Act already is in effect for casinos, mutual funds, credit-card firms, banks and "money service businesses" like the Bin & Barrel, which offer such things as check cashing and money transfers. Still others - jewelers, vehicle dealers, travel agents, loan companies, investment firms and people involved in real estate closings - are waiting for the government to issue their regulations under the act. As word about the law spreads, many business people don't like what they are hearing. "A lot of our members are just starting to wake up to all of the things they are required to do," said Karen Penafiel, assistant vice president for advocacy for the Building Owners & Managers Association International. When the group's executive committee held a briefing on the act in November, she said, "there was a sense that, 'you've got to be kidding."' Expecting businesses - especially tiny ones - to keep track of terrorists strikes some people as silly. "It's just lame," said Pat Kennedy, who owns Alpine Recreation, a Morgan Hill, Calif., RV dealership. "I'm trying to imagine any local terrorist picking up his motor home and doing a little camping." Palo Alto, Calif., attorney Jonathan Axelrad has similar concerns about the law's potential application to venture capital funds. Forcing the funds' managers to monitor money laundering "would simply be an expensive, unnecessary burden," he said, because the risks and withdrawal limits of such investments would likely be unattractive to terrorists. But terrorists are capable of using a wide range of businesses and purchases - including recreational vehicles - to hide their assets, according to federal officials, who insist the new rules already are paying off. They note that from Feb. 18, 2003, through Nov. 9, 2004, they received tips from various financial institutions about suspicious activity in 129 terrorism-related cases. That resulted in 648 grand jury subpoenas, nine arrests and two indictments. Even so, compliance with the act has been spotty so far. William Fox, director of the U.S. Treasury Department's Financial Crimes Enforcement Network, told Congress in September that only 21,058 of the estimated 200,000 money service businesses nationwide had registered with his agency, as required under the Patriot Act. Although firms that handle small transactions are exempt under the law, he testified, "we believe there are a significant number of money services business required to register that have failed to do so." The reason for that isn't clear. But even among companies that have heard of the law, many remain perplexed about its provisions. "There is mass confusion out in the business world on this," said Christopher Myers, an attorney who recently did an analysis of the laws' implications for real-estate companies. Some critics blame the law's vague wording. Consider its decree that anyone involved in real estate closings have procedures for deterring money laundering. In addition to buyers and sellers, industry experts say, that wording could apply to mortgage lenders, appraisers, surveyors, title insurers, escrow agents, environmental consultants and city building inspectors. Similar uncertainty surrounds Bush's order forbidding all 5.6 million of the nation's businesses from having dealings with anyone on the specially designated nationals list, which can be viewed at www.treas.gov/offices/enforcement/ofac/sdn/. Because the list of 5,000-plus names is regularly updated, many companies are using sophisticated software to check it against their customers' names. But the cost of software can range from $1,000 to well over $100,000. And it's not foolproof. "Inevitably, there will be many 'false positives' with the use of this software," according to a notice published by the Treasury Department's Office of Foreign Assets Control, which oversees the list. So to clarify if a customer is really on the list, the notice advises, business operators may have to go to the additional trouble of contacting their software supplier or the Treasury Department. In addition, depending on the type and size of the transactions involved, many businesses must fill out detailed "suspicious activity reports" and file them with the federal government within 30 days of discovering a customer is on the list. The Office of Foreign Assets Control has made public the names of some large businesses that have gotten fines or other penalties for failing to ensure their customers weren't on the list. But Molly Millerwise refused to disclose the names of any small businesses punished for such violations. "That's not available," she told the Mercury News. "It's nothing we have made public." Nonetheless, she said, small-business owners could wind up in big trouble if they assume they won't be prosecuted, adding that, "everyone is responsible for compliance." --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

In war on terrorism, U.S. drafts shops to be on guard
by Vinnie Moscaritolo 29 Dec '04

29 Dec '04

In war on terrorism, U.S. drafts shops to be on guard By Steve Johnson Knight Ridder Newspapers SAN JOSE, Calif. - It may surprise some people to learn that one of the linchpins in this nation's war on terrorism is the Bin & Barrel Mini Mart in Fremont, Calif. Manager Sonia Cheema certainly was when her dad bought the store in October. Under federal rules still being fine-tuned, she discovered, the Bin & Barrel - like thousands of other businesses - must have a written plan for foiling money-laundering terrorists. It also must have a "compliance officer" to ensure the plan is heeded, train its employees to spot shady transactions and regularly audit its own performance. That's not all. While not widely known, the Bin & Barrel and every other U.S. business must steer clear of people on the government's 192-page list of "specially designated nationals," which has more than 5,000 names and is updated frequently. Otherwise, business people could face huge fines and a long stay in prison. "Oh gosh! Imagine one person coming to cash a check and going through a list," said the 25-year-old Cheema, who has temporarily stopped cashing checks and processing money orders, at least until she understands the federal rules better. "It's going to be a lot of work. ... I don't think it's worth it." Previously, banks were pretty much the only businesses that had to worry about money launderers. But that changed after the terrorist attacks on Sept. 11. On Sept. 24, 2001, President Bush signed an executive order barring business dealings with anyone on the specially designated list, which includes the names and aliases of suspected terrorists, drug kingpins and their associates. Those failing to comply can be fined $10 million and jailed up to 10 years. That was followed a month later by enactment of the USA Patriot Act, which forces "financial institutions"- broadly defined to include everything from liquor stores to pawn shops - to have detailed programs for combating money launderers. Under its enforcement provisions, business operators face potential $500,000 fines and 10-year prison terms. The Patriot Act already is in effect for casinos, mutual funds, credit-card firms, banks and "money service businesses" like the Bin & Barrel, which offer such things as check cashing and money transfers. Still others - jewelers, vehicle dealers, travel agents, loan companies, investment firms and people involved in real estate closings - are waiting for the government to issue their regulations under the act. As word about the law spreads, many business people don't like what they are hearing. "A lot of our members are just starting to wake up to all of the things they are required to do," said Karen Penafiel, assistant vice president for advocacy for the Building Owners & Managers Association International. When the group's executive committee held a briefing on the act in November, she said, "there was a sense that, 'you've got to be kidding."' Expecting businesses - especially tiny ones - to keep track of terrorists strikes some people as silly. "It's just lame," said Pat Kennedy, who owns Alpine Recreation, a Morgan Hill, Calif., RV dealership. "I'm trying to imagine any local terrorist picking up his motor home and doing a little camping." Palo Alto, Calif., attorney Jonathan Axelrad has similar concerns about the law's potential application to venture capital funds. Forcing the funds' managers to monitor money laundering "would simply be an expensive, unnecessary burden," he said, because the risks and withdrawal limits of such investments would likely be unattractive to terrorists. But terrorists are capable of using a wide range of businesses and purchases - including recreational vehicles - to hide their assets, according to federal officials, who insist the new rules already are paying off. They note that from Feb. 18, 2003, through Nov. 9, 2004, they received tips from various financial institutions about suspicious activity in 129 terrorism-related cases. That resulted in 648 grand jury subpoenas, nine arrests and two indictments. Even so, compliance with the act has been spotty so far. William Fox, director of the U.S. Treasury Department's Financial Crimes Enforcement Network, told Congress in September that only 21,058 of the estimated 200,000 money service businesses nationwide had registered with his agency, as required under the Patriot Act. Although firms that handle small transactions are exempt under the law, he testified, "we believe there are a significant number of money services business required to register that have failed to do so." The reason for that isn't clear. But even among companies that have heard of the law, many remain perplexed about its provisions. "There is mass confusion out in the business world on this," said Christopher Myers, an attorney who recently did an analysis of the laws' implications for real-estate companies. Some critics blame the law's vague wording. Consider its decree that anyone involved in real estate closings have procedures for deterring money laundering. In addition to buyers and sellers, industry experts say, that wording could apply to mortgage lenders, appraisers, surveyors, title insurers, escrow agents, environmental consultants and city building inspectors. Similar uncertainty surrounds Bush's order forbidding all 5.6 million of the nation's businesses from having dealings with anyone on the specially designated nationals list, which can be viewed at www.treas.gov/offices/enforcement/ofac/sdn/. Because the list of 5,000-plus names is regularly updated, many companies are using sophisticated software to check it against their customers' names. But the cost of software can range from $1,000 to well over $100,000. And it's not foolproof. "Inevitably, there will be many 'false positives' with the use of this software," according to a notice published by the Treasury Department's Office of Foreign Assets Control, which oversees the list. So to clarify if a customer is really on the list, the notice advises, business operators may have to go to the additional trouble of contacting their software supplier or the Treasury Department. In addition, depending on the type and size of the transactions involved, many businesses must fill out detailed "suspicious activity reports" and file them with the federal government within 30 days of discovering a customer is on the list. The Office of Foreign Assets Control has made public the names of some large businesses that have gotten fines or other penalties for failing to ensure their customers weren't on the list. But Molly Millerwise refused to disclose the names of any small businesses punished for such violations. "That's not available," she told the Mercury News. "It's nothing we have made public." Nonetheless, she said, small-business owners could wind up in big trouble if they assume they won't be prosecuted, adding that, "everyone is responsible for compliance." --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cell phones for eavesdropping - finally some public "chatter"
by Gadi Evron 27 Dec '04

27 Dec '04

/Pun intended on the subject line!/ Okay, so, we have all known cell phones are "dangerous". Stepping out of the cellular protocols security and vendor-side systems, and forgetting for a second about interception of transmissions through the air, Trojan horses/worms that may install themselves on the cell phone and even bluetooth risks, there is the long talked of risk of "operating" a regular un-tampered cell phone from a far and the risk of modified devices. Sorry for stating the obvious, but cell phones are transmitters. For years now paranoid people and organizations claim that eavesdropping through a cell phone is a very valid risk. Much like somebody pressing "send" by mistake during a sensitive meeting is a very valid yet different risk. Some of the stricter organizations ask you to do anything from (top to bottom) storing the cell phone in a safe, through shutting it off or removing the battery, and all the way to *only* "don't have that around here while we are in a meeting". Then again.. *most* haven't even heard of this risk. Forgetting even this risk, many of us even ignore the obvious. I usually ask people who talk to me while I'm on the phone "even if the NSA (for example) is not interested in what I have to say or not capable of intercepting it and even that I don't care if they heard my conversations... Should the person I talk to hear our conversation?" Lately there seems to be some more awareness about the "dangers" of cell phones. Knowing which risk is more of a threat than the other is another issue. It seems to me that other than in the protocols, where there has been a serious learning curve (and GPRS seems very promising), cellular companies keep doing the same mistakes, and we can see the security problems of the PC world reappearing in cell phones, much like those of the main frames re-appeared in PC's (to a level). History repeated. Heck, I can't even disable Java or the web browser in most cellular computers (we really should refer to them as computers now). Here are some URL's on the subject: Here is one about modified cell phones, which also mentions the risk of eavesdropping through a cell phone as mentioned above: http://www.interesting-people.org/archives/interesting-people/200206/msg0003 1.html Here is a product for sale, a cellular phone BUILT for eavesdropping: http://wirelessimports.com/ProductDetail.asp?ProductID=347 Also, check out the IEEE Pervasive article that mentions this problem area, although discusses more the issue of malware: http://csdl.computer.org/comp/mags/pc/2004/04/b4011abs.htm Or Google for "symbian +virus", for example. Thanks go to David Dagon for the links. ------ End of Forwarded Message ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Cell phones for eavesdropping - finally some public "chatter"
by Gadi Evron 27 Dec '04

27 Dec '04

/Pun intended on the subject line!/ Okay, so, we have all known cell phones are "dangerous". Stepping out of the cellular protocols security and vendor-side systems, and forgetting for a second about interception of transmissions through the air, Trojan horses/worms that may install themselves on the cell phone and even bluetooth risks, there is the long talked of risk of "operating" a regular un-tampered cell phone from a far and the risk of modified devices. Sorry for stating the obvious, but cell phones are transmitters. For years now paranoid people and organizations claim that eavesdropping through a cell phone is a very valid risk. Much like somebody pressing "send" by mistake during a sensitive meeting is a very valid yet different risk. Some of the stricter organizations ask you to do anything from (top to bottom) storing the cell phone in a safe, through shutting it off or removing the battery, and all the way to *only* "don't have that around here while we are in a meeting". Then again.. *most* haven't even heard of this risk. Forgetting even this risk, many of us even ignore the obvious. I usually ask people who talk to me while I'm on the phone "even if the NSA (for example) is not interested in what I have to say or not capable of intercepting it and even that I don't care if they heard my conversations... Should the person I talk to hear our conversation?" Lately there seems to be some more awareness about the "dangers" of cell phones. Knowing which risk is more of a threat than the other is another issue. It seems to me that other than in the protocols, where there has been a serious learning curve (and GPRS seems very promising), cellular companies keep doing the same mistakes, and we can see the security problems of the PC world reappearing in cell phones, much like those of the main frames re-appeared in PC's (to a level). History repeated. Heck, I can't even disable Java or the web browser in most cellular computers (we really should refer to them as computers now). Here are some URL's on the subject: Here is one about modified cell phones, which also mentions the risk of eavesdropping through a cell phone as mentioned above: http://www.interesting-people.org/archives/interesting-people/200206/msg0003 1.html Here is a product for sale, a cellular phone BUILT for eavesdropping: http://wirelessimports.com/ProductDetail.asp?ProductID=347 Also, check out the IEEE Pervasive article that mentions this problem area, although discusses more the issue of malware: http://csdl.computer.org/comp/mags/pc/2004/04/b4011abs.htm Or Google for "symbian +virus", for example. Thanks go to David Dagon for the links. ------ End of Forwarded Message ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Stolen passports missed at U.S. borders
by R.A. Hettinga 24 Dec '04

24 Dec '04

<http://www.washingtontimes.com/functions/print.php?StoryID=20041223-113834-…> The Washington Times www.washingtontimes.com Stolen passports missed at U.S. borders By Jerry Seper THE WASHINGTON TIMES Published December 24, 2004 Foreign nationals applying for admission to the United States using stolen passports have "little reason to fear being caught" and usually are admitted, even when their fraudulent documents have been posted on the government's computerized "lookout" lists, a report said. The Department of Homeland Security's Office of Inspector General said in a 40-page report that of the 176 foreign nationals who its investigators identified as having used a stolen passport in an attempt to enter the United States from 1998 to 2003, 136 were admitted. "While most persons using stolen passports to enter illegally into the United States may be simply violating immigration laws, some could have more sinister intentions," said the department's acting inspector general, Richard L. Skinner. The report, completed in November but made public this week, also said when U.S. Customs and Border Protection (CBP) officers received new reports of stolen passports, they did not routinely review existing admission records to determine whether any already had been used. Even if there was such a procedure, the report said, CBP had no way to give the information on the stolen passports to U.S. Immigration and Customs Enforcement (ICE), Homeland Security's investigative arm. "While the 136 successful entries using stolen passports is a relatively small number, it is significant for several reasons," Mr. Skinner said. "First, the passports were obtained by criminal acts. Second, though small, the number could and should be zero, at least for those admissions that occurred after lookouts were posted. Third, there was no law-enforcement pursuit once it was recognized an illegal entry had occurred." Mr. Skinner said actionable information was reported and logged in the lookout system, yet entry was accomplished, "defeating a costly apparatus established precisely to prevent such an occurrence." The inspector general's probe targeted travelers from the 27 foreign countries for whom a visa is not required, including France, Germany and Britain. Although those travelers were told in October to present either a machine-readable passport or a U.S. visa, CBP has given officials at ports of entry the discretionary authority to grant one-time exemptions in an effort to facilitate travel. President Bush also has signed legislation delaying until October 2005 the requirement for visa-waiver countries to include biometrics in their passports. Mr. Skinner said the "vast numbers of stolen passports available" presented a significant challenge for U.S. immigration authorities, noting that Interpol estimated last year that more than 10 million lost and stolen passports are in circulation. CBP records show that during 2003, more than 12.7 million travelers to the United States from visa-waiver countries were inspected at ports of entry -- nearly 35,000 a day -- and that 4,368 fraudulent passports were intercepted. The United States had 40.4 million international visitors last year. According to the inspector general's report, of the 98 foreign nationals who did not have lookouts posted for their stolen passports before their attempted U.S. entry, 79 were admitted -- a rate of 81 percent. Of those 78 aliens who had posted lookouts on their passports, 57 gained entry -- a rate of 73 percent. Of those 57 who gained entry despite "lookouts" on their passports, 33 did so after the September 11 attacks. The report also said that 18 aliens whose passports had posted lookouts were referred by immigration officers to secondary inspections for more intensive interviews, but got in anyway. "We could not determine from the secondary inspections records, the inspectors' rationale for admitting the aliens with lookouts for the stolen passports," Mr. Skinner said, describing the records as nonexistent or "so sketchy that they were not useful." Mr. Skinner's report made several recommendations: *Primary inspectors should refer foreign nationals to secondary inspections when their passports are the subject of a lookout. *The inspectors should record in detail the results of the secondary inspections and justifications for any subsequent admission. *There should be a supervisory review and approval of a decision to admit an alien who was the subject of a lookout. *Inspectors should enter new names into the lookout database on a timely basis. *CBP should initiate routine reviews of admission records to identify prior uses of stolen passports. *Information on the successful use of stolen passports should be reported to ICE for investigation. Homeland Security Undersecretary Asa Hutchinson, who oversees CBP and ICE, said the inspector general's report had reached "overly broad and generalized conclusions" based on a limited study. But he said CBP agreed with the recommendations and had taken "prudent steps" to address them. Mr. Skinner also recommended that ICE develop procedures to investigate, locate and remove from the United States foreign nationals who have used stolen passports to gain entry to the country and to report the outcomes of its investigations to CBP. For those aliens who used stolen passports that have terrorist links, he said, ICE should investigate their activities while in the United States and determine their whereabouts. Mr. Hutchinson said efforts were under way to ensure that ICE investigated all questionable cases. CBP inspects the millions of foreign nationals arriving at the nation's land, sea and air ports of entry to determine their eligibility for admission. Secondary inspections are sought when more detailed information is required. ICE is responsible for enforcing immigration law in the nation's interior. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

A Force Field in Flat Gray to Protect a Wireless Network
by R.A. Hettinga 24 Dec '04

24 Dec '04

<http://www.nytimes.com/2004/12/23/technology/circuits/23pain.html?pagewante…> The New York Times December 23, 2004 A Force Field in Flat Gray to Protect a Wireless Network Adam Baer s wireless networks have proliferated, computer security companies have come up with increasingly complex defenses against hackers: password protection, encryption, biometrics. Insulating the interior of a house, apartment or office from radio-wave interference is a simpler concept that has yet to become a popular consumer strategy, but a new product called DefendAir from Force Field Wireless could change that. Available online at forcefieldwireless.com, the product is a latex house paint that has been laced with copper and aluminum fibers that form an electromagnetic shield, blocking most radio waves and protecting wireless networks. Priced at $69 a gallon and available only in flat gray (it can be used as a primer), one coat shields Wi-Fi, WiMax and Bluetooth networks operating at frequencies from 100 megahertz to 2.4 gigahertz. Two or three coats will achieve the paint's maximum level of protection, good for networks operating at up to five gigahertz. Force Field Wireless also sells a paint additive ($34 for a 32-ounce container, enough to treat a gallon of paint) and $39 window-shield films. Harold Wray, a Force Field Wireless spokesman, said the paint must be carefully applied. "Radio waves find leaks," he said. It should be applied selectively, he said, because it might hinder the performance of radios, televisions and cellphones. "Our main goal is to shield your wireless radio waves from hackers and outside interference," he said. "Plus, today, many people watch cable television." Adam Baer Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. passport privacy: Over and out?
by R.A. Hettinga 24 Dec '04

24 Dec '04

<http://www.iht.com/bin/print_ipub.php?file=/articles/2004/12/22/news/passpo…> U.S. passport privacy: Over and out? By Hiawatha Bray The Boston Globe Thursday, December 23, 2004 It's December 2005 and you're all set for Christmas in Vienna. You have your most fashionable cold-weather gear, right down to Canada's national red maple leaf embroidered on your jacket and backpack, to conceal your American citizenship from hostile denizens of Europe. But your secret isn't really safe. As you stroll through the terminal, you pass a nondescript man with a briefcase. The briefcase contains a powerful radio scanner, and simply by walking past, you've identified yourself as an American. Without laying a finger on you, the man has electronically "skimmed" the data in your passport. Science fiction? The American Civil Liberties Union doesn't think so. Neither does Bruce Schneier, software engineer and author of multiple books on computer security, nor Katherine Albrecht, a privacy activist in Cambridge, Massachusetts. They are all worried about a State Department plan to put radio identification tags in all future U.S. passports, beginning next year. That way, American passport data can be read merely by waving it past a radio detector. But whose radio detector? That's what worries many people. "Somebody can identify you as an American citizen from across the street because of the passport in your back pocket," said Albrecht, founder of a Web site concerned with the matter, spychips.com. "You're a walking target." Nonsense, replies a State Department spokeswoman, Kelly Shannon. "We're going to prevent the unauthorized skimming of the data," Shannon said. The U.S. government thinks the new passports will be harder to forge and easier to verify than the current model, without causing undue risk of identity theft. It is all part of the continuing debate over radio frequency identification systems, also known as RFID. Tags that let people zoom through a highway toll booth contain an RFID chip. Many American pets have them embedded under their skin and the U.S. Food and Drug Administration has approved doing the same for people, to provide reliable medical information to emergency room doctors. But privacy advocates like Albrecht contend that government agencies and big corporations want to embed RFID chips into virtually every product, giving them the ability to track almost every move that people make. The RFID chips contain a tiny bit of information that is transmitted via radio when the chip comes within range of a reading device. The chip could broadcast a simple code number, or it could contain a lot more information, like a traveler's name, nationality and digital photograph. This is what the chips planned for future U.S. passports will do, part of a plan to make the passport system more secure. But according to government documents released by the civil liberties union, early versions of the system allowed detection of personal data by a snoop 30 feet, or 9 meters, away. Shannon, of the State Department, dismissed this research, saying the equipment needed to capture the data was too complex and heavy to be used undercover. That is not much comfort to Schneier, the computer security expert. "Technology only gets better," he said. "It never gets worse." Schneier figures that would-be spies and snoops will find ways to pick up signals from the passport chips. The chips might be made more secure by encrypting the data they contain. That way, it would be useless even if intercepted. But the State Department opposes that idea, because immigration officials in many poor countries cannot afford the necessary decryption gear. "Encryption limits the global interoperability of the passport," said Shannon. Why use a radio-based identity system at all? Smart chips, like those found in some credit cards, are plentiful and cheap, and they don't broadcast. You slide them through a chip reader that instantly scoops up the data. But the International Civil Aviation Organization, which sets global standards for passports, has decided on the use of a "noncontact" technology - another way of saying radio-based identification. So will Americans be stuck with high-tech passports that beam their personal data to all comers? Not necessarily. Turns out there's a simple fix: a passport cover made of aluminum foil. It would form what engineers call a Faraday cage, after Michael Faraday, the 19th-century British physicist who discovered the characteristics of electromagnetic waves. Wrap an RFID chip inside a Faraday cage, and the electromagnetic waves from the chip reader can't get in and activate the chip. The State Department says it may use the principle to give travelers an added sense of security. No, there won't be rolls of aluminum foil included with every passport. Instead, the passport cover may include a network of wires woven into the fabric. Fold the passport shut, and there's your Faraday cage. Even Schneier agrees that a properly shielded passport cover should solve the problem. He wonders why this wasn't included in the original plans for the new passports. "It took a bunch of criticism before they even mentioned it," Schneier said. And he hopes the anti-snooping technology is thoroughly tested before the new passports are introduced next spring. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Finally, the Killer PKI Application
by R.A. Hettinga 24 Dec '04

24 Dec '04

<http://sys-con.com/story/print.cfm?storyid=47592> (SYS-CON)(Printview) Finally, the Killer PKI Application Web Services as an application - and a challenge December 22, 2004 Summary Enterprise PKI has a bad name. Complex, costly, difficult to deploy and maintain - all these criticisms have dogged this technology since it first appeared. To the dismay of so many CIOs, few applications have stepped up to make effective use of PKI. But this may soon change: Web services promotes a security model that demands the flexibility that an enterprise PKI deployment can offer. By Scott Morrison Enterprise PKI has a bad name. Complex, costly, difficult to deploy and maintain - all these criticisms have dogged this technology since it first appeared. To the dismay of so many CIOs, few applications have stepped up to make effective use of PKI. But this may soon change: Web services promotes a security model that demands the flexibility that an enterprise PKI deployment can offer. The Trend Away from Channel-Level Security If you lumped all the existing, production-level Web services applications together, and categorized their security models, you would probably discover some interesting trends. First, an awful lot of these don't address security at all, which probably owes more to the relative immaturity of Web services technology than to a conscious choice on the part of developers. The bulk of the remainder will simply delegate security entirely to SSL - or in some cases, a VPN connection. SSL isn't a bad choice. It provides confidentiality and integrity. Automatic sequence numbering stands guard against replay attacks. Servers are always authenticated using a certificate that binds the server's DNS name to the Subject, a strategy to defeat man-in-the-middle and impersonation attacks. This does rely heavily on the integrity of the DNS system, but by and large it is viewed as an acceptable risk. SSL even offers optional client-side certificate authentication, which is powerful, though in practice rarely implemented. Probably the most unheralded quality of SSL is channel continuity. Once a session is set up - and once the client and server mutually authenticate (with the client using a certificate under SSL, through HTTP authentication, or an application-level means such as forms) - a level of trust is established on the open socket so that it is available for multiple transactions without repeating this lengthy process each time. There is great value in a transparently maintained security context, and it is easy to take for granted. Of course, one of the reasons behind SSL's success on the Web was that, although it utilizes public key cryptography, it doesn't need full-blown PKI. Most SSL-enabled Web servers use certs issued by the "browser cartel," those CAs fortunate enough to have their root certificates automatically installed within the trust store of the most popular browsers. And with the exception of a few early consumer banking products - which have largely been abandoned - almost nobody steps up to the baroque logistics of client-side certificates on the Web. The ability to delegate PKI to a third party greatly simplified security on the Web; this was one of the reasons SSL became good enough for most online transactions, even when challenged in the early days by technically elegant, though complex, solutions like SET (Secure Electronic Transaction). But SSL's greatest weakness is that it is oriented toward synchronous transactions, requiring a direct connection between participants. It's like an encrypted telephone conversation, which is probably something alien to you and me, but I suppose that James Bond uses it regularly. Both parties need to be available, multiple passes are necessary to set up a secure context, and all of the information - the critical points alongside the mundane ("how's the weather in London?") - is encrypted wholesale, which can be a costly processor burden. This is why SSL is an insufficient security model for Web services. Despite the name - an unfortunate one that is probably one of the great misnomers in the history of technology - Web services isn't really about the Web. In one realization, it does use existing Web infrastructure, including HTTP transport, Web application servers, etc. However, Web services is fundamentally a one-way messaging paradigm for computer communications, composed around a simple XML message structure with an extensible header model. Web service messages may not piggyback on HTTP at all. They might flow across a message-oriented middleware (MOM) such as IBM's MQSeries, or be carried asynchronously by that other ubiquitous infrastructure, SMTP. SOAP messages are designed to flow through a network of intermediates, not unlike IP packets being passed between routers. Intermediates may be required to view header information to make processing decisions based on application-level protocol. A channel-based security model, one that encrypts everything and requires synchronous responses from a receiver, simply isn't appropriate in such a Web services architecture. Security in the Message The solution to this problem, as put forth in standards by OASIS and the W3C, is to absorb security into the message itself. That is, provide a means of authentication, integrity, and confidentiality that is integral to the message, and completely decoupled from transport channels. Thus, the message security remains consistent and trustworthy whether it flows over regular HTTP across a P2P network using proprietary protocols, is persisted to a file, or even printed onto a piece of paper. Ironically, it's closer to the time-honored cryptographic tradition of writing encrypted information into a message and sending it via a messenger than it is to Mr. Bond's fancy, synchronous encrypting telephone. This may strike you as lower tech, but a security model that supports asynchronous messaging has great architectural advantages. In the Oasis Web Services Security (WSS) standard, each SOAP message stands alone, and can have security applied uniquely. It includes mechanisms for encrypting any content in the message at a very finely grained level. For example, rather than applying a cipher to the entire message, only those parts that are deemed necessary to cryptographically secure need be encrypted, such as a credit card number. This means that public parts of a message, such as header fields that might be relevant to an intermediate making a routing decision, can be left in the clear. Of course, any part of a SOAP message is subject to modification by an attacker as it traverses potentially hostile networks. To address this, WSS provides a mechanism to sign message content, with a granularity identical to encryption. Thus, not only can a message author encrypt the credit card element, they can sign it to ensure that no substitution in transit goes undetected. The same protection can be extended to unencrypted, public elements, such as timestamps inserted into the header. A Role for PKI WSS goes to great lengths to remain flexible and not to specify a particular encryption/signing technology. It's certainly possible to build a WSS-compliant system based on shared secrets that are exchanged out-of-band of the WSS specification (though this disqualifies a transaction from any claims to nonrepudiation, as well as subjecting it to a toxic list of potential security flaws). Nevertheless, you would be hard-pressed to find a vendor's WSS implementation that isn't based on public key infrastructure. Furthermore, everyone is building systems predicated to have key pairs on both sides of a transaction: at the message producer (client), and the message consumer (server). So PKI is back. This is good news if you spent a lot of money a few years back on a large, enterprise-wide PKI rollout. It was painful, and probably unrecognized, but now the investment may finally be realized. If you avoided PKI until now, Web services may be the application that forces your organization to swallow this often bitter pill. The Typical Pattern To understand why PKI is so essential to the typical WSS implementation, it helps to examine a common interaction model (see Figure 1). A single message is secured for transmission between two parties. This is a sessionless scenario, meaning that there is no prenegotiated, temporary security token shared between parties. In other words, there is no shared secret between the producer and the consumer, such as a key used for symmetric encryption and HMAC signing. Emerging standards, such as WS-Secure Conversation and WS-Trust, provide for negotiated security tokens and define well-known key derivation mechanisms similar to SSL's session key scheme. In this instance, we are illustrating how a message can be secured directly using only the key pair and certificate held by the producer, and the certificate for the consumer. Figure 2 shows a map of the message exchanged between the producer and the consumer. In this simplified message, the body has been encrypted using a two-step process described in WSS. First the producer generates a random symmetric key to encrypt the body content, using a symmetric algorithm like triple-DES or AES. A specialized security header describes the exact algorithm and key length. Note the contrast here to SSL, which supports negotiation of cipher suites and key lengths. This is largely to accommodate a diversity of clients, any of whom may be subject to cryptography export restrictions. Here we assume a prior, out-of-band agreement on cipher capabilities. So how does this shared secret become, well, shared? It's pretty simple. The producer encrypts this symmetric key with the consumer's public key, ensuring that only that party can decrypt the message. This encrypted key is then embedded in the security header, with a reference to the key pair needed to unlock it (often, this is implemented using the subject key identifier field from the receiver's certificate). In the security header, anyone can read the encrypted key, but only the designated receiver can decrypt it, and use it to further decipher the message content. Thus, no complex, multipass protocol is required to negotiate a security session key. Each message stands alone. Encryption, however, is only one component of the security story, albeit an important one. As it stands, the encrypted message body is subject to substitution by a malicious party, as are critical header fields such as the timestamp, which is necessary for servers to uniquely identify messages and apply an effective replay defense. Furthermore, the consumer has no means to authenticate the message producer: encryption for a particular receiver does not identify the author - the message could have come from anyone. To address this shortcoming, our message producer calculates digests of the encrypted message body and critical header fields, and places these into yet another block in the security header. It signs this block, aggregating the digested components into a single, simultaneous integrity/origin authentication statement. The producer includes its certificate (or a reference to it) in the security header so that the receiver can validate the signature and follow any certificate chain in the certificate to a trust anchor. Now the consumer can have confidence that a specific producer authored the message, it was not altered in transit, and most importantly, that it was designated specifically for this consumer. What is important to recognize here is that all parties in this transaction have key pairs and certificates. Without PKI, the model doesn't work. Conclusion Clearly, Web services is a great opportunity for PKI, but it's also a great challenge. Most vendors' toolkits have a deliberately vague coupling to commercial PKI systems. As always, it's what the standards loosely describe that becomes the source of problems. Interfacing to a particular key store type or location, coercing servers to check CRLs or use OCSP can be troublesome. It's best to start proactively, rolling out your PKI system before its services are demanded by a Web services application. And the demand will come. SSL is sufficient for Web-like, client/server application, but large enterprise computing is built on asynchronous messaging; this is where Web services will shine, and where PKI will become essential. About the author Scott Morrison is director of Architecture at Layer 7 Technologies. Layer 7 provides technology for managing and coordinating Web services security and transaction policy across loosely coupled systems (more) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1