April 2004 - cypherpunks-legacy

Signs Point to Worm Attack on SSL Vulnerability
by R. A. Hettinga 29 Apr '04

29 Apr '04

<http://www.eweek.com/print_article/0,1761,a=125527,00.asp> EWeek Signs Point to Worm Attack on SSL Vulnerability April 27, 2004 By Dennis Fisher Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol. During the morning and early afternoon Tuesday, specialists at VeriSign Inc.'s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual. ADVERTISEMENT "The attacks are too heavy and too regular to be anything but a worm. This has to be a worm or a mass rooter," said Jerry Brady, chief security officer of managed security services at VeriSign, based in Mountain View, Calif. "The activity is at much too high of a rate for it to be people manually using the exploit." The vulnerability, for which Microsoft Corp. released a patch earlier this month, is in an older Microsoft protocol called PCT (Protected Communications Transport). Microsoft's SSL library contains a buffer overrun flaw that enables attackers to run arbitrary code on vulnerable machines by sending specially designed PCT handshake packets. PCT is included in the SSL library, which is present in a number of products, including IIS and Exchange Server. VeriSign and other security services warned of this vulnerability last week. Click here to read more about the previous alert and the specific action of this exploit. Brady said the majority of the company's managed services customers who have Internet-facing IIS servers have been attacked already. He added that the company is in the process of breaking down the attacks to see whether they are installing back doors or Trojans on compromised machines. "It's too soon to tell right now. We're still doing the forensics at this point," Brady said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

For Icahn, ImClone Purchase Was a Good Thing
by R. A. Hettinga 29 Apr '04

29 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This *this* boys and girls, is *exactly* why "insider" trading laws are just so much statist happy horseshit. As we see below, one woman's trash is another man's treasure, and *nobody* knows which is which, no matter *how* much "inside" information they have. As in anything else, *nobody* can calculate the future value of information, "inside" or otherwise. The value of *anything* can *only* be *discovered* in a free market, and not calculated, in mind or machine, much less legislated by vote, fiat, or anything in between. Even in the worst cases, so-called "insiders" know just as much as you or I do about the future value of any stock, including that of their own companies: exactly nothing. "Insider" trading regulation wasn't even *promulgated* until the early 1960's, at the height of government hubris about it's ability to "regulate" everything. Something that has been shown, from the price of gold, to the price of gas, to the availability of airline seats, to be evil, if not stupid. In the case of "insider" trading, just because you have information about shareholder positions in almost realtime, like they were able to do with the advent of computer-based book-entry settlement and manditory registration of equity positions, doesn't mean that you have an obligation to control it. If somebody took an axe to all government "regulation" of the economy, particularly from about the passage of the 16th amendment -- about 1916 or so -- we would be enormously better off. Not that it'll ever happen of course, but I feel like venting this morning... Cheers, RAH - ------- <http://online.wsj.com/article_print/0,,SB108318701386996379,00.html> The Wall Street Journal April 29, 2004 HEARD ON THE STREET For Icahn, ImClone Purchase Was a Good Thing Investor Faces $250 Million Profit From Bet Made as Stewart Sold; Time to Take the Money and Run? By SUSAN PULLIAM Staff Reporter of THE WALL STREET JOURNAL April 29, 2004; Page C1 Talk about zigging when others zagged. By now, everyone knows how Martha Stewart was alerted by a Merrill Lynch & Co. brokerage assistant that Sam Waksal, her friend and founder of ImClone Systems, was trying to sell the biotech company's shares. Less well known, however, is the story of how financier Carl Icahn was buying ImClone shares that very day, possibly even snapping up the same shares that Ms. Stewart was unloading. Mr. Icahn recently disclosed in a filing with the Securities and Exchange Commission that he owns 5.24 million shares of ImClone, a stake he first began accumulating with a purchase of 10,000 shares on Dec. 27, 2001, people close to the situation say. After his purchase on Dec. 27, Mr. Icahn stopped buying ImClone for a few months. As the scandal unfolded and the share price fell to below $10 in the summer of 2002, Mr. Icahn began buying ImClone shares again, adding 3.6 million shares to his holdings. He bought the stock again earlier this year, picking up 1.63 million shares. That purchase brought his average purchase price to $19.58, according to the SEC filing. His profit, with ImClone shares now at $70 each, the level where they were before the scandal hit would be a cool $250 million. So much for the value of a tip from a broker. Ms. Stewart was recently convicted on criminal charges of lying to prosecutors about the facts surrounding her sale of ImClone stock, which she sold at about $58. Her lawyers have asked for a new trial on the grounds that one of the jurors lied on his courtroom questionnaire. Mr. Waksal, meanwhile, is serving a seven-year jail sentence after pleading guilty to insider-trading charges. But Mr. Icahn, who is famous for his contrarian bets, went the opposite direction of the ImClone inner circle, believing that the drop in the stock represented a chance to pick up a bargain, say people close to the situation. Mark Weitzen, Mr. Icahn's lawyer, declined to comment. BUYING OPPORTUNITY While Martha Stewart was unloading her ImClone shares, Carl Icahn starting to build up his stake. See how ImClone's stock0 has performed since 2001. ImClone shares began falling in December 2001, from $75 on Dec. 6 to $46.46 on Dec. 28, when ImClone announced that the Food and Drug Administration had refused to review its application to market Erbitux, ImClone's promising new cancer drug. The stock continued to plunge to a low of around $6 in the summer of 2002, after news surfaced that Mr. Waksal had tipped off his family about the development, triggering an investigation. Around the same time, prosecutors launched an investigation of Ms. Stewart's sale of ImClone stock. It turns out Mr. Icahn's instincts were right. This February, the FDA finally approved Erbitux for use against colon cancer. On Tuesday, ImClone reported a big jump in earnings on the strength of Erbitux and a licensing payment by Bristol-Myers Squibb Co. connected to the approval of the drug. Earnings for the New York biotechnology company totaled $62.7 million, compared with a loss of $34.8 million a year earlier. In 4 p.m. trading yesterday on the Nasdaq Stock Market, ImClone shares fell 63 cents to $69.31. The question now is how long Mr. Icahn will hang on to his ImClone shares. If history is any guide, he could be thinking of taking some money off the table. That is because Mr. Icahn's latest gain in ImClone stock follows a nearly identical profit of $250 million on an investment in ImClone in December 2000, when Mr. Icahn disclosed in an SEC filing that a group, including himself, owned more than six million shares of ImClone. Mr. Icahn's group sold those shares in mid-2001 at around $70 each. That was a few months before Bristol-Myers bought a big stake in ImClone. Mr. Icahn's sale back then preceded a big drop in ImClone's shares to below $40. People close to the situation say the financier joked at the time with Mr. Waksal that he was selling the shares because it was his rule of thumb to sell when an investment gain totals "a quarter of a billion dollars." It isn't clear whether Mr. Icahn applies that rule the second time around. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQJERh8PxH8jf3ohaEQKYjQCgrqJyIgYG7vogBKd5fnRVAp5OYKIAoIOV PadwJRMUlQ6yhC+TMeC2QIll =g7cW -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

looping test (#2)
by Riad S. Wahby 29 Apr '04

29 Apr '04

Looping test, please ignore. -- Riad Wahby rsw(a)jfet.org MIT VI-2 M.Eng

1 0

test
by Ryan Lackey 29 Apr '04

29 Apr '04

this may or may not go through; I don't know. -- Ryan Lackey [RL960-RIPE AS24812] ryan(a)venona.com +1 202 258 9251 OpenPGP DH 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F

2 1

<nettime> Britain: Blunkett to legislate for thought crimes and guilt by association
by R. A. Hettinga 29 Apr '04

29 Apr '04

--- begin forwarded text

1 0

ID card scheme �2,500 fine threat
by R. A. Hettinga 29 Apr '04

29 Apr '04

<http://news.bbc.co.uk/2/low/uk_news/politics/3659355.stm> The BBC Monday, 26 April, 2004, 18:41 GMT 19:41 UK ID card scheme #2,500 fine threat People who refuse to register for the government's planned ID card scheme could face a "civil financial penalty" of up to #2,500, it has emerged. David Blunkett said not making registering a criminal issue would avoid "clever people" becoming martyrs. And he promised strict limits on the type of information stored on ID cards. Under Monday's draft bill, carrying false papers will be a criminal offence but MPs have until 2013 to decide if registration should be compulsory. 'Soft touch' Details of card holders kept on the National Identity Register will include name, address and previous addresses as well as nationality and immigration status. Mr Blunkett also confirmed that people will have the right to see their entry on the register. He said ID cards were needed to prevent the UK becoming a "soft touch" for terrorists. But DNA and other health information would not be included on the cards and there would be an independent regulator to control the type of information they contain. Royal family Legislation is expected to be introduced to Parliament in the autumn, with the first biometric passports, which store fingerprint or iris scan information, issued in 2005 and the first cards carrying fingerprint details in 2007. HOW SCHEME WILL WORK Passport price hike of #35 to meet #3.1bn cost of ID card scheme Postal passport applications would no longer be possible 2008: 80% of economically active population will carry some form of biometric identity document 2013: MPs to vote on whether registration should be compulsory New ID would require people to sit in a "biometric enrolment pod" which photographs them and scans the face and iris Information is recorded on a microchip and in a central database Source: Home Office Ministers will make the final decision on compulsory registration by 2013, as detailed in the government's original timetable published in November. By that time, Mr Blunkett expects 80% of the population to hold biometric identification either in the form of a passport, a driving licence or a voluntary ID card. Asked whether members of the Royal Family would be required to apply for a card if compulsion is introduced, Mr Blunkett said: "We are all subjects and citizens." Illegal working A trial of identity card technology was launched on Monday involving 10,000 volunteers. Ministers believe that as well as fighting terrorism, the cards will help to crack down on ID fraud, human trafficking and illegal working, as well as stopping people exploiting health and welfare services. Mr Blunkett claimed the biometric system would make UK ID cards impossible to forge - unlike cards used elsewhere in Europe. Safeguards Liberal Democrat home affairs spokesman Mark Oaten said: "I would much rather see the #3bn that's going to be incurred in looking at better intelligence". Shadow Home Secretary David Davis said the Tories backed the idea of ID cards but said safeguards had to be put in place to prevent the misuse of personal information. The draft Bill sets out proposals for a national identity register to hold details of all 60 million people in the UK. This will enable a person's identity to be authenticated when they produce their card. The legislation also sets out safeguards to prevent government officials from misusing the data. As part of a large-scale test of the equipment, volunteers are having biometric details recorded, involving facial scans, iris scans and fingerprints. Trials are beginning at the UK Passport Service's London HQ on Monday, with further trials to be held in Leicester, Newcastle and Glasgow The biometric checks will become compulsory for anyone applying for, or renewing, passports from 2007. Biometrics will also be introduced into driving licences later. If cards are made compulsory, they will have to be produced to access a range of public services including the NHS and benefits. The estimated #3.1bn cost of introducing the scheme will be met by increasing the cost of passports. Civil rights campaign group Liberty said the government was effectively introducing an identity tax. Liberty director Shami Chakrabarti said there were privacy implications, while no government had yet shown itself competent to manage such databases. The Home Affairs select committee said it would be placing the draft bill under close scrutiny. As part of the inquiry, the committee will take evidence from the Home Secretary David Blunkett MP on 4 May and will also be calling for written submissions on the draft bill as part of the process of pre-legislative scrutiny. People who want to take part in the trial should send an email to trial(a)mori.com. BIOMETRICS OPTIONS Facial scanning: A camera with appropriate software records face contours and converts them into code. A computer processes the data and checks against stored record. Iris imaging: Software scans a digital image of the iris to compare its unique pattern with all those stored. Fingerprinting: A scanner reads the ridge patterns and compares the converted code with those on a database. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

message, but also test
by Ryan Lackey 29 Apr '04

29 Apr '04

I have two questions: 1) Does anyone have actual performance measurements of ZKS from when it was operational/at peak, in terms of bandwidth, MTU, latency, and jitter? Is there a good way to quantify just how far from "acceptable" it was? 2) Does anyone know of any existing reviews of bandwidth cost in multiple jurisdictions (say, per 1Mbps CIR international terrestrial), as well as electricity (per-Kwh)? I'm working on a research report which shows the 5-10 year costs for a few specific businesses in as many different locations and jurisdictions as possible, since otherwise it's almost impossible to quantify how much "better" a jurisdiction is than any other. I know bandwidth costs for all the markets I actually care about, but I'd like to flesh this out to account for more individual countries. The problem is the bandwidth numbers I have are public as well as very aggressively negotiated, and there's usually a spread of 3-10x between them, so I'd rather not have to go through that level of negotiation for any additional data points. (some people have been sending to cypherpunks(a)metacolo.com vs. cypherpunks(a)cypherpunks.metacolo.com, which was causing a bunch of cypherpunks mail to accumulate in the catchall spool for metacolo.com. I just added cypherpunks and cypherpunks-* aliases in the metacolo domain as well, so it should work, of which this is a test) (I also subscribed the al-qaeda node, and will probably finish setting up the spamfiltered version of the list, as well as passing the back archives through the same archiving software as current archives, and search-indexing them, next time I get bored) -- Ryan Lackey [RL960-RIPE AS24812] ryan(a)venona.com +1 202 258 9251 OpenPGP DH 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F _______________________________________________ cypherpunks mailing list cypherpunks(a)cypherpunks.metacolo.com http://cypherpunks.metacolo.com/mailman/listinfo/cypherpunks

1 0

test 2
by Ryan Lackey 29 Apr '04

29 Apr '04

-- Ryan Lackey [RL960-RIPE AS24812] ryan(a)venona.com +1 202 258 9251 OpenPGP DH 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F

1 0

BBC on all-electronic Indian elections
by Graham Lally 29 Apr '04

29 Apr '04

Current report: <http://news.bbc.co.uk/1/hi/world/south_asia/3641419.stm> The tech: <http://news.bbc.co.uk/1/hi/world/south_asia/3493474.stm> Bit scant on details.. anyone know anything more about how the machine (/system) "is fully tamper-proof"? .g -- "I Me My! Strawberry Eggs"

11 27

Sinners help
by Sasha K. Watson 28 Apr '04

28 Apr '04

e.R.X.s Stay Longer! Go HARDER! BE BIGGER! On Sale For A Short Time Only! Enjoy the most intense orgasms of your life! Become immensely confident. * Increased circulation and ENLARGE your girth and size up to 3 inches or even larger * Increased semen and sperm production up to 600 percent * Increased testosterone up to 500 percent * Obtain GIANT rock-solid more powerful erections * Have LONGER LASTING erections * Increased libido and vitality have more energy for vigorous activity * Best of all, Recommended by real doctors eRXs is not doctor prescribed and its for men and women! Go here for more details. No Thanks, Opt Me Out w lxe

1 0