May 2004 - cypherpunks-legacy

RE: AP is back...
by Tyler Durden 07 May '04

07 May '04

"Terrorists in Fallujah claim they'll give $15 million each for the heads of Defense Secretary Donald Rumsfeld, Lt. Gen. Ricardo Sanchez and Brig. Gen. Mark Kimmit." Well, does the actual HEAD have to be delivered? That might reduce the options considerably... -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: AP is back... >Date: Fri, 07 May 2004 08:38:20 -0700 > >We in al Qaeda organization are committed to a prize of 10,000 grams of >gold to whoever kills Bremer, >his deputy, the commander of American forces or his deputy in Iraq," the >voice said. > >Bin Laden also offers 1kg of gold for killing a US >soldier or civilians, and 500 grams for killing an allied >civilian or soldier. > >Terrorists in Fallujah claim they'll >give $15 million each for the heads of >Defense Secretary Donald Rumsfeld, Lt. Gen. >Ricardo Sanchez and Brig. Gen. Mark Kimmit. > > >------- >How do you declare this on your 1040? >Can Americans involved in friendly-fire incidents collect? > > > _________________________________________________________________ Check out the coupons and bargains on MSN Offers! http://youroffers.msn.com

1 0

AP is back...
by Major Variola (ret) 07 May '04

07 May '04

We in al Qaeda organization are committed to a prize of 10,000 grams of gold to whoever kills Bremer, his deputy, the commander of American forces or his deputy in Iraq," the voice said. Bin Laden also offers 1kg of gold for killing a US soldier or civilians, and 500 grams for killing an allied civilian or soldier. Terrorists in Fallujah claim they'll give $15 million each for the heads of Defense Secretary Donald Rumsfeld, Lt. Gen. Ricardo Sanchez and Brig. Gen. Mark Kimmit. ------- How do you declare this on your 1040? Can Americans involved in friendly-fire incidents collect?

1 0

Explosive Debate: Should U.S. Check Up On Model Rockets?
by R. A. Hettinga 07 May '04

07 May '04

<http://online.wsj.com/article_print/0,,SB108388303399504572,00.html> The Wall Street Journal May 7, 2004 PAGE ONE Explosive Debate: Should U.S. Check Up On Model Rockets? Under 9/11 Law, ATF Keeps Tabs on Propellant Buyers; Feds Visit Al's Hobby Shop By ROBERT BLOCK Staff Reporter of THE WALL STREET JOURNAL May 7, 2004; Page A1 ELMHURST, Ill. -- Al's Hobby Shop in this leafy corner of suburban Chicago is always packed with mothers looking for Cub Scout badges, teenagers ogling imported slot cars and grown men playing with model trains. But to federal law-enforcement officials, Al's is also a possible terrorist supply depot. And so, last October, a special agent from the Bureau of Alcohol, Tobacco, Firearms and Explosives was sent to Al's from Washington to buy $1,700 in model rocket motors. "The guy told me that the government wanted to do some tests," recalls Tim Lehr, who sold the agent 40 motors containing almost 60 pounds of propellant. "He wouldn't say what the tests were for, but I could guess: The government wanted to ruin my hobby." Since the passage of the initial post-9/11 antiterrorism laws in October 2001, hobby rocketry has been struggling to avoid regulation that enthusiasts say will destroy their sport, deter youngsters from pursuing an interest in science and waste the nation's limited law-enforcement resources. The Department of Justice says that federal agents need to keep an eye on who is buying model rockets because the toys are potentially dangerous and could be adapted by terrorists to attack airplanes and American soldiers. At the heart of the problem is a long-running dispute between hobbyists and the ATF, which is part of the Justice Department, over how to legally classify the chemicals used to propel rockets. Ammonium perchlorate composite propellant, better known as APCP, is a rubbery mixture of resins, powdered metals and salts that ignites at 500 degrees Fahrenheit and burns like a road flare on steroids. It's the same fuel that the National Aeronautics and Space Administration uses in the solid rocket boosters on the space shuttle. For hobby rockets, APCP comes in the form of pellets wrapped in cardboard about an inch in diameter and three inches long. The cylinders, which start at $12.50 apiece and can go up into the hundreds of dollars, can be stacked in reusable aluminum casings to power larger rockets. Rocketeers have always maintained that APCP doesn't detonate, it deflagrates. That is, it burns intensely at a controlled rate. Since 1971, however, the ATF has branded APCP as a "low explosive" subject to regulation and licensing by the bureau. In practice, the ATF largely ignored the rocketeers as long as they weren't selling or buying APCP across state lines. With new fears about national security after 9/11, President Bush signed the Safe Explosives Act, an antiterrorism law contained in the bill that created the Department of Homeland Security. In effect for a year, the law now requires permits for all purchases of rocket motors and all explosives, including APCP. Suddenly, hobbyists who had been freely purchasing such motors for years had to be fingerprinted and to submit to background checks. They had to pay $25 for ATF low-explosive-user permits to purchase more than 2.5 ounces of APCP and allow local and federal inspectors onto their property anytime to check for proper storage of the propellant. The government insists it is trying to balance civil liberties with homeland safety. But federal investigators say that since terrorists showed they could level skyscrapers with boxcutters, no potentially suspicious activity can be ignored. "Most of the people involved in these activities are harmless fanatics and nerds," says one federal law-enforcement official. "But since 9/11, we have a responsibility to make sure the nerds are not terrorists." Other hobbyist have also come under federal scrutiny, including bird watchers on the Canadian border and operators of radio-controlled airplanes. But this does little to console the rocketeers. Terry McCreary, associate professor of analytical chemistry at Murray State University in western Kentucky and a hobby-rocket guru, says sport rocketry helps kids by interesting them in wonders of chemistry, physics, astronomy and aerodynamics. "If you look deeply into the background of our top mathematicians and scientists, you will find a kid with a model rocket." Pointing at a troop of about 15 Boy Scouts at a recent launch in The Plains, Va., Doug Pratt, who runs his own hobby-rocket business out of his basement in Herndon, asked: "Does that look like a group of terrorists to you?" Faced with the prospect of being fingerprinted and having agents poking around their past, many rocketeers are leaving the hobby. The rocket club at Kettering University in Michigan has closed down because of the new regulatory requirements. Looking for help, rocket groups have turned to Republican Sen. Mike Enzi of Wyoming, an avid fan of hobby rockets and model airplanes. In May last year, Senator Enzi sponsored a bill to exempt hobby rockets from government regulation. The Department of Justice, which oversees the ATF, then wrote him a letter saying that "large rocket motors could be adapted by terrorists for use in surface-to-air missiles capable of intercepting commercial and military airplanes at cruise level and for use in 'light antitank' weapons capable of hitting targets from a range of nearly five miles." Mr. Enzi wrote back to Attorney General Ashcroft, asking to see the results of the tests that led his department to its conclusions. Within weeks, an agent from the ATF was sent to Al's Hobby Shop outside Chicago to buy the first rocket motors for testing. Over the past six months, according to ATF officials, agents and private contractors have been working at Air Force bases in Utah and Florida firing model rockets at drones, vehicles and simulated crowds of people. The tests are classified. Some rocketeers have hit upon another solution: They make their own fuel. They get together on weekends with pizza, beer and jars of precursor chemicals for "cooking parties" in their homes and apartments or in the back rooms of their businesses. "It's legal and completely safe," says Jerry O'Sullivan, an insurance agent who cooks fuel with his friends in suburban Washington. Mr. O'Sullivan, who is a member of the Maryland Delaware Rocketry Association Inc., is taking advantage of a loophole in explosives legislation exempting anyone who mixes an explosive for his own "personal" use from having to get a permit. The exemption was created mainly for farmers who mix fertilizers and fuel oil to blast their own irrigation ditches. One oddity of the government crackdown is the focus on rockets and not guidance systems. "The secret is in the guidance systems," says Arthur "Trip" Barber, a former captain of a U.S. navy guided missile destroyer, who is now vice president of the National Association of Rocketry. "I can build a rocket overnight but I couldn't build a guidance system in a lifetime." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Acoustic Cryptanalysis
by John Young 07 May '04

07 May '04

http://www.wisdom.weizmann.ac.il/~tromer/acoustic/ Acoustic Cryptanalysis: On nosy people and noisy machines Adi Shamir and Eran Tromer A powerful method for extracting information from supposedly secure systems is side-channel attacks, i.e., cryptanalytic techniques that rely on information unintentionally leaked by computing devices. Most attention has been focused on electromagnetic emanations, power consumption and, recently, diffuse visible light from CRT displays. The oldest eavesdropping channel, namely acoustic emanations, has received little attention. The following demonstrates some preliminary results in the analysis of acoustic emanations from personal computers, showing them to be a surprisingly rich source of information on CPU activity. May 7, 2004

1 0

E-Voting Commission Gets Earful
by R. A. Hettinga 07 May '04

07 May '04

<http://www.wired.com/news/print/0,1294,63349,00.html> Wired News E-Voting Commission Gets Earful By Michael Grebb? Story location: http://www.wired.com/news/evote/0,2645,63349,00.html 02:00 AM May. 06, 2004 PT WASHINGTON -- Passions ran high Wednesday at the first public hearing of the Election Assistance Commission, where activists and manufacturers of electronic voting machines clashed over whether new e-voting systems should include a voter-verifiable paper trail that auditors could use to recount votes if necessary. The newly formed commission, which is just beginning to oversee the certification of voting systems and the standardization of elections across the country, held its first meeting to examine the state of elections and voting systems. The commissioners were collecting testimony from special-interest groups, election officials, computer scientists and voting-machine makers. But the commission's chairman said he didn't expect the bipartisan panel would issue national standards requiring paper receipts when it makes preliminary recommendations next week, followed by more detailed guidelines next month. "We will not decide on what machines people will buy," said the chairman, Republican DeForest B. Soaries Jr., saying it wasn't the panel's role to tell states what to do. "We will say, if California wants to have a backup paper system, what national standards it should follow." At least 20 states are considering legislation to require a paper record of every vote cast after rushing to get ATM-like voting machines to replace paper ballots in the wake of Florida's fiasco with hanging chads in the 2000 presidential election. About 50 million people, or 29 percent of voters, are expected to vote electronically in November's election. Representatives from the machine makers tried to convince commissioners that paperless e-voting systems are not only safe and accurate, but more so than paper-based systems. Mark Radke, director of marketing at Diebold Election Systems, said Diebold's touch-screen voting systems experienced "zero security problems" during the November 2002 elections, pointing out that its "voice guidance" audio feature allowed blind voters "to vote in private for the very first time." (With paper-only systems, blind voters historically have needed to recite their ballot choices to a poll worker or friend, who would then mark the ballot for them.) Radke also said Diebold's machines outperformed other systems during the California recall elections in October. He claimed that under-counted votes were the lowest on Diebold touch screens, at 0.73 percent, compared with 2.86 percent for optical-scan systems, 4.6 percent for other electronic systems and 6.32 percent for paper-only systems. Alfie Charles, spokesman for Sequoia Voting Systems, said the "sensationalized concerns" of paper-trail advocates aren't grounded in reality. "The evidence is pretty clear," he said. "Electronic systems help prevent disenfranchisement." Several panelists also pointed out that the pool of people able to hack into an e-voting system is far smaller than those able to steal ballots, stuff the ballot box or punch holes in voting cards to change or nullify votes. Under that theory, electronic systems would increase security. "We would reduce the number of people capable of committing fraud," Charles said. But Avi Rubin, a Johns Hopkins University computer scientist who helped author a report last July about security vulnerabilities in Diebold's touch-screen voting system, warned that paperless systems could allow savvy intruders to rig an election. He said corporations supporting a particular presidential candidate who is friendly to their needs would have billions at stake to make sure their candidate won. "We've got very well-funded and bad-intentioned adversaries to worry about," he said. Rubin said while paper trails are needed for the November election, "in the long, long term we should explore other cryptographic options and other electronic techniques" to someday run secure, paperless elections. At a press conference and rally outside the hearing, a crowd of supporters cheered when California Secretary of State Kevin Shelley took the podium. On Friday, Shelley banned the use of one model of Diebold's voting machines in four California counties, and decertified all touch-screen systems unless counties that own them implement 23 security requirements. At least one county is filing suit against Shelley for his actions, and others may follow. Supervisors in Riverside County voted unanimously Tuesday to sue Shelley, California's top election official, to remove the ban on their machines, saying his ruling would harm disabled and visually impaired voters who have been able to vote unassisted for the first time using touch-screen machines that guide them through the ballot with audio directions. Shelley charged that Diebold aggressively marketed its TSx system to voting officials in the four counties, even though the systems were not fully tested, qualified by federal officials or certified at the state level. Diebold finally finished federal testing of the TSx on April 21. Still, Shelley told supporters that he worries most about unsecured systems vulnerable to hackers. "We have seen that a bunch of high-school students can hack in and change thousands of votes," he said. "We cannot have that." He said he had received several reports of high-school hackers attempting to penetrate e-voting systems, but didn't give specific examples. One of his representatives also cited an incident in which touch-screen systems went down in a few jurisdictions during the October recall election. Elderly poll workers at one location didn't know what to do, so they asked some teenagers who happened to be there to reboot the machines for them -- an obvious opportunity to commit mischief under the right circumstances. Several witnesses at the hearing, including Shelley, recommended better training for poll workers, who may need basic computer skills to fix technical problems on Election Day. Brit Williams, a computer science professor and election expert at Kennesaw State University near Atlanta, advocated adopting a single national standard for voting software to ensure security and ease training for poll workers. Other commissioners seemed worried that poll workers would become too reliant on vendors to fix Election Day snafus. Some experts have said that the most likely hacking scenario for machines would be inside jobs from system programmers or the vendors themselves. But Denise Lamb, director of elections in New Mexico, told the panel that any polling place that experienced a severe software or hardware problem would most likely shut down rather than call in a vendor to fix the problem. For minor glitches, she said most vendors provide telephone support. Activists outside the hearing, however, were not reassured. "This is a high-stakes election, and we have to get it right," said Linda Schade, director of Campaign for Verifiable Voting in Maryland, a group that advocates a voter-verified paper trail for electronic systems rather than "rickety, backward new voting machines." The group has already sued the state of Maryland in an effort to decertify the Diebold touch-screen machines that officials implemented statewide last year. Rep. Rush Holt (D-New Jersey) took the podium to drum up support for his Voter Confidence and Increased Accessibility Act (HR2239), which would require all voting machines to produce a paper record. "(Paperless e-voting machines) are in principle unverifiable," he said. "Your intentions cannot be recovered." As Holt wrapped up his comments, Jim Dickson, spokesman for the American Association of People With Disabilities, stepped forward and complained that Holt's bill would threaten to undo protections for disabled voters contained in the Help America Vote Act of 2002. Dickson, who is blind, said that voting with assistance can be a humiliating experience, particularly when the poll worker helping you doesn't agree with your choices. "They have said, 'You're voting for who?'" he said, mimicking the sarcastic voice of a poll worker. He charged that Holt's bill -- by not setting a deadline for new e-voting machines to accommodate disabled voters -- would put off those protections indefinitely. Holt quickly clarified that his bill wouldn't take away such protections. While the sides squared off in Washington, D.C., senators in California approved a bill to ban all e-voting in the state in November. The bipartisan bill passed the state Senate Committee on Elections and Reapportionment with a 3-1 vote and will now go to the Senate floor. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

AuP: 'Al-Qaeda' offers gold for deaths
by R. A. Hettinga 07 May '04

07 May '04

<http://news.bbc.co.uk/2/low/middle_east/3692079.stm> The BBC Thursday, 6 May, 2004, 21:52 GMT 22:52 UK 'Al-Qaeda' offers gold for deaths Rewards of gold are said to be on offer for the assassinations of top US and UN officials, according to a message purportedly from Osama Bin Laden. The statement said 10kg (22lb) of gold would be given to anyone killing the US Iraq administrator Paul Bremer or senior military officers. The same - worth about $125,000 - was offered for UN chief Kofi Annan or his Iraq envoy Lakhdar Brahimi. The message was published on a website known to be used by Islamist militants. It was claimed that the statement was the transcript of an audio recording by the al-Qaeda leader. The authenticity of the statement has not been verified, but observers say it used language similar to previous Bin Laden statements, laden with Koranic verse. But they add that he has never before offered rewards for missions which he considers to be a religious duty. The US has offered a $27m bounty for the capture or killing of Bin Laden. "We in al-Qaeda organisation will guarantee, God willing, 10,000 grams of gold to whoever kills the occupier Bremer, or the American chief commander or his deputy in Iraq," the purported transcript read. Smaller rewards of 1kg of gold were offered for the deaths of ordinary Americans and Britons, and half that was pledged for the killings of citizens of Japan and Italy, who were called "slaves" of the UN Security Council. The website offered various links to hear the original audio statement, but users said they could not get them to work - possibly because of the number of people trying. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[FoRK] How To Attack Scale-Free Networks (fwd from jbone@place.org)
by Eugen Leitl 07 May '04

07 May '04

----- Forwarded message from Contempt for Meatheads <jbone(a)place.org> -----

1 0

The Internet's Wilder Side
by R. A. Hettinga 06 May '04

06 May '04

Warning. Do not drink and read this at the same time. Your keyboard and screen are not safe. Cheers, RAH ------- <http://www.nytimes.com/2004/05/06/technology/circuits/06chat.html?pagewante…> The New York Times May 6, 2004 The Internet's Wilder Side By SETH SCHIESEL T was just another Wednesday on the sprawling Internet chat-room network known as I.R.C. In a room called Prime-Tyme-Movies, users offered free pirated downloads of "The Passion of the Christ'' and "Kill Bill Vol. 2.'' In the DDO-Matrix channel, illegal copies of Microsoft's Windows software and "Prince of Persia: The Sands of Time,'' an Xbox game, were ripe for downloading. In other chat rooms yesterday, whole albums of free MP3's were hawked with blaring capital letters. And in a far less obtrusive channel, a hacker may well have been checking his progress of hacking into the computers of unsuspecting Internet users. Even as much of the Internet has come to resemble a pleasant, well-policed suburb, a little-known neighborhood known as Internet Relay Chat remains the Wild West. While copyright holders and law enforcement agencies take aim at their adversaries on Web sites and peer-to-peer file-sharing networks like Napster, I.R.C. remains the place where people with something to hide go to do business. Probably no more than 500,000 people are using I.R.C. worldwide at any time, and many of them are engaged in legitimate activities, network administrators say. Yet that pirated copy of Microsoft Office or Norton Utilities that turns up on a home-burned CD-ROM may well have originated on I.R.C. And the Internet viruses and "denial of service'' attacks that periodically make news generally get their start there, too. This week, the network's chat rooms were abuzz with what seemed like informed chatter about the Sasser worm, which infected hundreds of thousands of computers over the weekend. "I.R.C. is where you are going to find your 'elite' level pirates,'' said John R. Wolfe, director for enforcement at the Business Software Alliance, a trade group that fights software piracy. "If they were only associating with each other and inbreeding, maybe we could coexist alongside them. But it doesn't work that way. What they're doing on I.R.C. has a way of permeating into mainstream piracy.'' Two weeks ago, the F.B.I., in conjunction with law enforcement agencies in 10 foreign countries, announced an operation called Fastlink, aimed at shutting down the activities of almost 100 people suspected of helping operate illegal software vaults on the Internet. The pirated copies of music, films, games and other software were generally distributed using a separate Internet file-transfer system, said a Justice Department spokesman, but the actual pirates generally used I.R.C. to communicate and coordinate with one another. "The groups targeted as part of Fastlink are alleged to have used I.R.C. to have committed their crimes, like almost all other warez groups,'' the spokesman, Michael Kulstad, said in a telephone interview. Warez, pronounced like wares, is techie slang for illegally copied software. When I.R.C. started in the 1980's, it was best known as a way for serious computer professionals worldwide to communicate in real time. It is still possible - though sometimes a bit difficult - to find mature technical discussions among the tens of thousands of I.R.C. chat rooms, known as channels, operating at any one time. There are also respectable I.R.C. systems and channels - some operated by universities or Internet service providers - for gamers seeking opponents or those who want to talk about sports or hobbies. Still, I.R.C. perhaps most closely resembles the cantina scene in "Star Wars'': a louche hangout of digital smugglers, pirates, curiosity seekers and the people who love them (or hunt them). There seem to be I.R.C. channels dedicated to every sexual fetish, and I.R.C. users speculate that terrorists also use the networks to communicate in relative obscurity. Yet I.R.C. has its advocates, who point to its legitimate uses. "I.R.C. is where all of the kids come on and go nuts,'' William A. Bierman, a college student in Hawaii who helps develop I.R.C. server software and who is known online as billy-jon, said in a telephone interview. "All of the attention I.R.C. has gotten over the years has been because it's a haven for criminals, which is a very one-sided view. "The whole idea behind I.R.C. is freedom of speech. There is really no structure on the Internet for policing I.R.C., and there are intentionally no rules. Obviously you're not allowed to hack the Pentagon, but there are no rules like 'You can't say this' or 'You can't do that.' " It is almost impossible to determine exactly how many people use I.R.C. and what they use it for, because it takes only some basic technical know-how to run an I.R.C. server. Because it is generally a text-only medium, it does not require high-capacity Internet connections, making it relatively easy to run a private I.R.C. server from home. Some Internet experts believe that child pornography rings sometimes use their own private, password-protected I.R.C. servers. Particularly wary users can try to hide their identity by logging in to I.R.C. servers only through intermediary computers. There are, however, scores of public I.R.C. networks, like DALnet, EFNet and Undernet. Each typically ties together dozens of individual chat servers that may handle thousands of individual users each. "We're seeing progressively more and more people coming onto the network every year,'' said Rob Mosher, known online as nyt (for knight), who runs a server in the EFNet network. "As more and more people get broadband, they are moving away from AOL and they still want to have chat.'' For end users, using I.R.C. is relatively simple. First, the user downloads an I.R.C. client program (in the same way that Internet Explorer is a Web client program and Eudora is an e-mail client program). There are a number of I.R.C. clients available, but perhaps the most popular is a Windows shareware program known as mIRC (www.mirc.com) When users run the I.R.C. program, they can choose among dozens of public networks. Within a given network, it does not really matter which individual server one uses. Alternately, if users know the Internet address of a private server, they can type in that address. Once logged in to a public server, the user can generate a list of thousands of available channels. On an unmoderated network, the most popular channels are often dedicated to trading music, films and software. That is because in addition to supporting text-only chat rooms, I.R.C. allows a user to send a file directly to another user without clogging the main server. That capability has a lot of legitimate uses for transferring big files that would be rejected by an e-mail system. Want to send your brother across the country a digital copy of your home movie without burning a disc and putting it in the mailbox? The file-transfer capability in I.R.C. may be the most convenient way. Naturally, that file-transfer capability also has a lot of less legitimate uses. Advanced I.R.C. pirates automate the distribution of illegally copied material so that when a user sends a private message, the requested file is sent automatically. It is fairly common on I.R.C. for such a system to send out hundreds or even thousands of copies of the same file (like a music album or a pirated copy of Windows) over a few weeks. An official from the Recording Industry Association of America said that some hackers even obtain albums that have been recorded but not yet released. "Quite often, once they get their hands on a prerelease, they will use I.R.C. as the first distribution before it goes out into the wider Internet,'' Brad A. Buckles, the association's executive vice president for antipiracy efforts, said in a telephone interview. But perhaps the most disruptive use of I.R.C. is as a haven and communications medium for those who release viruses or try to disable Web sites and other Internet servers. In some ways, the biggest problem is Microsoft Windows itself. Windows has holes that can allow a hacker to install almost anything on a computer that lacks a protective program or device called a firewall. Users' vulnerability can be compounded if they have not installed the latest patches from Microsoft. Hackers scan through millions of possible Internet addresses looking for those unprotected computers and then use them to initiate coordinated "denial of service'' attacks, which flood the target machine (say, a Web site) with thousands or millions of spurious requests. In all of the noise, legitimate users find the target site unavailable. How can a hacker direct his army of compromised drones to the target of the day? Through I.R.C. "Each time it breaks into a new computer and turns it into a drone, the program copies itself and proceeds to keep scanning, and so very quickly you can have a very large number of drones,'' Mr. Bierman said, adding that a worm may well include a small custom-made I.R.C. client. "Then all of the drones connect to I.R.C. and go into one channel made especially for them. Then the runner can give commands to all of those drones.'' Chris Behrens, an I.R.C. software developer in Arizona known online as Comstud, said: "It's amazing how many machines at home are hacked or have been exploited in some way. We have seen 10,000 hacked machines connect to I.R.C. at one time, and they all go park themselves in a channel somewhere so someone can come along and tell them who to attack.'' Mr. Bierman and other I.R.C. developers and administrators said that they were contacted by federal law enforcement officials fairly often. Mr. Bierman said that he sometimes cooperated in helping the government track down specific people using I.R.C. to wage major attacks. He added, however, that he had refused government officials' requests to build a back door into his I.R.C. software that would allow agents to monitor I.R.C. more easily. "Basically the F.B.I. is interested in the best way to monitor the traffic,'' Mr. Bierman said. Mr. Kulstad of the Justice Department declined to comment on its specific contacts with the I.R.C. community. Mr. Bierman and other I.R.C. administrators said that in addition to their free-speech concerns, they were also reluctant to confront hackers, because angry hackers often turn their drones against I.R.C. servers themselves. Mr. Mosher echoed other I.R.C. administrators in saying that attempts to regulate the shady dealings online were doomed to failure. "Look, if we find one channel and close it, they move to another,'' he said. "It's been like this for years. You can't really stop it.'' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: [IP] microsoft offers "whitelist"
by Tyler Durden 06 May '04

06 May '04

Well, I want a piece of this! What I want is a sort of $$$-barrier that I can raise or lower as my mood hits me. If a spammer (be it Citibank or "Do U Want a Bigger Pe-ni$" is willing to pre-pay above my barrier, then the spam hits my inbox (I make no claim that I'll read it, however....), and I get a few cents. I can raise or lower the barrier any way/time I want. Every now and then I may even make some purchase to encourage more spammers to send me money (as they exchange target email lists). -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: e$(a)vmeng.com, cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: [IP] microsoft offers "whitelist" >Date: Wed, 5 May 2004 18:13:09 -0400 > >"A whitelist for my friends." Check. > >"All others pay cash." Next? Anybody get this? Anybody?? > >;-). > >Cheers, >RAH >------ >--- begin forwarded text > > >Date: Wed, 05 May 2004 09:26:10 -0400 >To: ip(a)v2.listbox.com >From: Dave Farber <dave(a)farber.net> >Subject: [IP] microsoft offers "whitelist" >Sender: owner-ip(a)v2.listbox.com >Reply-To: dave(a)farber.net >List-ID: <ip(a)v2.listbox.com> >List-Help: <http://v2.listbox.com/doc/help_sub?list_name=ip@v2.listbox.com> >List-Subscribe: <mailto:subscribe-ip@v2.listbox.com>, ><http://v2.listbox.com/subscribe/?listname=ip@v2.listbox.com> > > >Microsoft offers anti-spam bypass >Hotmail, MSN operator adopts program that will allow marketers to bypass >filters by paying a bond. >May 5, 2004: 6:28 AM EDT > >WASHINGTON (Reuters) - Microsoft Corp. said Wednesday it has adopted an >e-mail "whitelist" program by IronPort Systems Inc. that will allow >legitimate marketers to thread the gauntlet of spam filters protecting its >in-boxes. > >Microsoft's Hotmail and MSN e-mail services, which together claim 170 >million regular users, will require marketers to put money up front if they >wish to ensure their messages aren't mistaken for unwanted spam. > >IronPort's "Bonded Sender" service guarantees that legitimate marketers who >post a cash bond and adhere to a set of guidelines will get their messages >delivered. > >"It's the exact opposite of blocking. It says, 'Hey you're a good guy, I'm >not going to run you through the metal detectors," said Tom Gillis, >IronPort's vice president for marketing. > >Such a "whitelist" approach requires the active cooperation of marketers -- >a much more likely prospect now that Microsoft has signed up, Gillis said. > >Unsolicited bulk messages now account for roughly two-thirds of all e-mail, >according to several estimates. > >Internet providers use filters to examine incoming messages and consult >"blacklists" to block traffic from computers known to send out spam. > >IronPort's approach rewards e-mail senders who agree to be held accountable >for their messages. > >Participating marketers must demonstrate a history of responsible e-mailing >and must provide an easy way for consumers to opt out of future mailings, >among other things. > >Those found to be engaging in abusive behavior forfeit a cash bond of up to >$20,000, Gillis said. > >Internet providers are considering other ways to make e-mail more reliable. >Both Microsoft and Yahoo Inc. (YHOO: Research, Estimates) are developing >authentication systems that could make it harder for spammers to >appropriate others' e-mail addresses. > >Other methods would make spamming less profitable by sucking up computing >power or requiring human input every time a message is sent. > >"When you add these up over time, it will be uneconomical to send out >spam," said Microsoft spam specialist George Webb. > >------------------------------------- >You are subscribed as rah(a)shipwright.com >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting-people/ > >--- end forwarded text > > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > _________________________________________________________________ Express yourself with the new version of MSN Messenger! Download today - it's FREE! http://messenger.msn.com/go/onm00200471ave/direct/01/

1 0

Book Review: Malicious Cryptography- Exposing Cryptovirology
by R. A. Hettinga 06 May '04

06 May '04

<http://netsecurity.about.com/cs/encryptionbooks/gr/aaprmalcrypto.htm> About.com Book Review: Malicious Cryptography >From Tony Bradley, CISSP, Your Guide to Internet/Network Security. Guide Rating - The Bottom Line Most people are familiar with malware- viruses, worms, Trojans, etc.- and most people are familiar, at least with the concept, of cryptography. However there are far fewer people that truly understand either of these technologies, and even fewer still who understand how the two can be combined to create the next generation of malicious code. Good reading, but a certain level of understanding of malware and cryptography is needed in order to follow the information in this book. Pros * Cutting edge look at new threats on the malware horizon * Informative without being boring * Appendices provide basics of viruses and PKI Cons * Solid understanding of cryptography and malware needed Description * Opening chapter provides engaging fictional look at the potential impact of malicious cryptography * Basics of viruses and PKI are provided in appendices, but this book is not for beginners * Cutting edge information on how cryptography might impact malware development Guide Review - Book Review: Malicious Cryptography Almost everyone (or should that be literally everyone) who has touched a computer keyboard is familiar with malware in some way. Not a day goes by it seems without news of the latest Netsky or Bagle variant. Many people remember the impact Codered, Nimda, SQL Slammer, MyDoom and other malware threats have had on them or the Internet as a whole over the past few years. A much smaller subset of people is familiar with cryptography. Some users may be aware that encryption is an option or they may have heard that they should encrypt their data or protect their email communications with encryption, but they don't "understand" cryptography. Those people probably shouldn't bother trying to read this book. Those who do understand cryptography- who know what MD5, Blowfish, RSA or 3DES mean and how they work- should probably read this book. Being on an intermediate level in cryptography myself I found some of the concepts and details required me to do some extra digging and research to understand, but I found the book to be informative and intriguing. The book seems to waiver in search of an audience- at times covering the information at a higher level that many network and security administrators can grasp and at other times delving into detail that only true cryptographers will follow- but the authors combine information about malware and cryptography in a way that experts from each can comprehend. Overall, this is a good book that I recommend- but not for beginners. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0