August 2004 - cypherpunks-legacy

[ISN] Hack . . . hack back . . . repeat
by InfoSec News 12 Aug '04

12 Aug '04

http://www.nwfusion.com/news/2004/080904defcon.html By Rodney Thayer Network World 08/09/04 LAS VEGAS - Capture the flag might be only a game, but it was serious business at DefCon, the world's largest annual computer hacker convention. For 36 straight hours, eight teams of experienced hackers and serious security professionals played predator and prey as they tried to hack into competitors' networks while defending their own. From my front-row seat as a member of the winning team, Sk3wl of R00t (hacker slang for "School of Root," where "root" refers to gaining administrator access to a system), I got a bird's-eye view of how new - and not so new - attacks could be launched and thwarted. Each qualified team playing the game - organized by a Seattle security community group called the Ghetto Hackers - controlled a pair of Windows machines running a variety of network and Web-based services that were connected to each other and a central scoring mechanism called the Scorebot via a Gigabit Ethernet network. Rest assured, this hacker network was not connected to the Internet. As soon as the doors to the secluded hacker playground disguised as a hotel ballroom were opened at 10 a.m. July 30, the air was tense in this crowded room. The game scenario and the legitimately purchased Windows images were presented to participants two hours before the official noon start time. How would you like to have to lock down two Windows boxes in just two hours as you started to recognize that there were world-class exploit developers in the room - and on your network? A team scored by attacking rivals' servers and stealing flags (data strings stored within the servers). The successful hacker then presented the stolen flags to the scoring system for credit. The overall score was a combination of credit for attacking other teams' servers and successfully defending your own services. Penalties were issued for excessive consumption of bandwidth, so simple port scans and brute force attacks were not used, and denial-of-service attacks were forbidden. In the middle of the room sat the Ghetto Hackers' gear, necessary for keeping the game within bounds and blasting loud techno music for the entire 36-hour ride. We'd trained for the competition in small conference rooms with similar tunes blaring as white noise to desensitize. But by the time it was 2 a.m., and you were staring at a network trace flying by on a screen, you noticed that your heartbeat and your breathing synchronized with the music and the packet traffic. At that point, it was time to take a walk. At the beginning everyone was organized with their supplies. Our cooler was stocked with ice and Coke. As time dragged on, people started bringing in food and drinks. At first we were organized and sent out someone for bread and cold cuts. But by the middle of Day Two we gave up and started ordering pizza. We stuck with soda for the most part, but as the contest wore on, a beer or two appeared. As we scanned the room (discreetly, of course) we saw the other teams behaving the same way if not more so. One team had a steadily draining bottle of Southern Comfort on top of its server. The Ghetto Hackers' full-length equipment rack was ornamented by a large, red, wooden arch in the style of a Japanese archway complete with Asian script. Our Japanese language expert slunk over for a closer look and determined the writing on the wall to be complete gibberish, with no hidden message to help us crack the code. Each team carefully arranged its equipment - everything from laptop Macs to Cisco switches, some piled 3 feet high on the allotted two tables - around the periphery of the room. Teams were supposed to have a maximum of 15 members, but no one stuck to that upper limit as the flow in and out of the room easily boosted each roster to more than 20 people. The ground rules I agreed to dictate that I not divulge individuals' identities. But in general terms I can say the teams included at least two CTOs; security professionals from Ernst & Young, AOL and the University of California at Santa Barbara; and well-known and unknown hackers. Additionally, at least four teams had members hailing from the U.S. Department of Defense. We mostly kept to ourselves and minimized visible screen space to avoid becoming vulnerable to "shoulder surfing" or other forms of spying. You also had to do some reconnaissance to sniff out any secret deals being cut to share or trade information among teams. Think "Survivor," when it was good. There wasn't exactly a book on how to organize your team or set strategy for this sort of thing. But our winning strategy as a team was organization. We organized everything from a rotating "cat nap" schedule to divvying up jobs along lines of expertise. Because offense was 80% of the overall score, you had to maintain support for your front-line attackers. The trick was to not ignore your defenses. If your defenses slipped, other teams could get in and score. As the Ghetto Hackers pointed out at the awards ceremony, we were solid attackers - not significantly better than other teams - but we had very good defense and were able to keep other teams from stealing flags from us. Most attacks we saw were levied against information in the database. Someone would figure out how to run the Wiki (a piece of server software that lets users freely create and edit Web page content using any Web browser) and do some obscure set of queries that would reveal flag data. Or someone would go into the Multi-User Dungeon, online game environments that use a great deal of bandwidth, and figure out if you walked north through the forest just the right way you'd be able to pick up a flag. We saw many failed attacks. Someone tried to buffer overflow the Web server with 800,000-byte null packets. Someone else tried to go after SNMP services to gain entry. Teams even attempted to capture their incoming Scorebot traffic and replay that same traffic in the direction of our machines in the hopes that our services would mistake them for the actual Scorebot and give up flags to them. If I were to apply my experiences to a more everyday situation than what was taking place at the off-the-strip Alexis Park hotel, five points would bubble to the top of the security cauldron: Unsecure, unnecessary services - such as terminal services and SNMP - are running on most Windows machines. You've got to take care to shut down or firewall all unnecessary ports used by these services. * Passwords are revealed frequently. To defend against this, periodically change all passwords, including those that give access to Web services and databases. * Customized Web applications typically leak critical information. To defend against this, applications must be modified so they do not have commands that give too much information without proper authorization or let users modify objects out of turn. * Unmonitored services are dangerously open to attack. Watch your logs like a hawk. * Hack attacks happen. Be very, very afraid. Thayer is principal investigator with Canola & Jones, a security research firm in Mountain View, Calif. He can be reached at rodney(a)canola-jones.com. Acknowledgements Thanks to the Ghetto Hackers for running a great contest. They put together a complex game and made it run under very stressful conditions and it worked great. Thanks also to Sk3wl of R00t for letting me join in. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Hack . . . hack back . . . repeat
by InfoSec News 12 Aug '04

12 Aug '04

http://www.nwfusion.com/news/2004/080904defcon.html By Rodney Thayer Network World 08/09/04 LAS VEGAS - Capture the flag might be only a game, but it was serious business at DefCon, the world's largest annual computer hacker convention. For 36 straight hours, eight teams of experienced hackers and serious security professionals played predator and prey as they tried to hack into competitors' networks while defending their own. From my front-row seat as a member of the winning team, Sk3wl of R00t (hacker slang for "School of Root," where "root" refers to gaining administrator access to a system), I got a bird's-eye view of how new - and not so new - attacks could be launched and thwarted. Each qualified team playing the game - organized by a Seattle security community group called the Ghetto Hackers - controlled a pair of Windows machines running a variety of network and Web-based services that were connected to each other and a central scoring mechanism called the Scorebot via a Gigabit Ethernet network. Rest assured, this hacker network was not connected to the Internet. As soon as the doors to the secluded hacker playground disguised as a hotel ballroom were opened at 10 a.m. July 30, the air was tense in this crowded room. The game scenario and the legitimately purchased Windows images were presented to participants two hours before the official noon start time. How would you like to have to lock down two Windows boxes in just two hours as you started to recognize that there were world-class exploit developers in the room - and on your network? A team scored by attacking rivals' servers and stealing flags (data strings stored within the servers). The successful hacker then presented the stolen flags to the scoring system for credit. The overall score was a combination of credit for attacking other teams' servers and successfully defending your own services. Penalties were issued for excessive consumption of bandwidth, so simple port scans and brute force attacks were not used, and denial-of-service attacks were forbidden. In the middle of the room sat the Ghetto Hackers' gear, necessary for keeping the game within bounds and blasting loud techno music for the entire 36-hour ride. We'd trained for the competition in small conference rooms with similar tunes blaring as white noise to desensitize. But by the time it was 2 a.m., and you were staring at a network trace flying by on a screen, you noticed that your heartbeat and your breathing synchronized with the music and the packet traffic. At that point, it was time to take a walk. At the beginning everyone was organized with their supplies. Our cooler was stocked with ice and Coke. As time dragged on, people started bringing in food and drinks. At first we were organized and sent out someone for bread and cold cuts. But by the middle of Day Two we gave up and started ordering pizza. We stuck with soda for the most part, but as the contest wore on, a beer or two appeared. As we scanned the room (discreetly, of course) we saw the other teams behaving the same way if not more so. One team had a steadily draining bottle of Southern Comfort on top of its server. The Ghetto Hackers' full-length equipment rack was ornamented by a large, red, wooden arch in the style of a Japanese archway complete with Asian script. Our Japanese language expert slunk over for a closer look and determined the writing on the wall to be complete gibberish, with no hidden message to help us crack the code. Each team carefully arranged its equipment - everything from laptop Macs to Cisco switches, some piled 3 feet high on the allotted two tables - around the periphery of the room. Teams were supposed to have a maximum of 15 members, but no one stuck to that upper limit as the flow in and out of the room easily boosted each roster to more than 20 people. The ground rules I agreed to dictate that I not divulge individuals' identities. But in general terms I can say the teams included at least two CTOs; security professionals from Ernst & Young, AOL and the University of California at Santa Barbara; and well-known and unknown hackers. Additionally, at least four teams had members hailing from the U.S. Department of Defense. We mostly kept to ourselves and minimized visible screen space to avoid becoming vulnerable to "shoulder surfing" or other forms of spying. You also had to do some reconnaissance to sniff out any secret deals being cut to share or trade information among teams. Think "Survivor," when it was good. There wasn't exactly a book on how to organize your team or set strategy for this sort of thing. But our winning strategy as a team was organization. We organized everything from a rotating "cat nap" schedule to divvying up jobs along lines of expertise. Because offense was 80% of the overall score, you had to maintain support for your front-line attackers. The trick was to not ignore your defenses. If your defenses slipped, other teams could get in and score. As the Ghetto Hackers pointed out at the awards ceremony, we were solid attackers - not significantly better than other teams - but we had very good defense and were able to keep other teams from stealing flags from us. Most attacks we saw were levied against information in the database. Someone would figure out how to run the Wiki (a piece of server software that lets users freely create and edit Web page content using any Web browser) and do some obscure set of queries that would reveal flag data. Or someone would go into the Multi-User Dungeon, online game environments that use a great deal of bandwidth, and figure out if you walked north through the forest just the right way you'd be able to pick up a flag. We saw many failed attacks. Someone tried to buffer overflow the Web server with 800,000-byte null packets. Someone else tried to go after SNMP services to gain entry. Teams even attempted to capture their incoming Scorebot traffic and replay that same traffic in the direction of our machines in the hopes that our services would mistake them for the actual Scorebot and give up flags to them. If I were to apply my experiences to a more everyday situation than what was taking place at the off-the-strip Alexis Park hotel, five points would bubble to the top of the security cauldron: Unsecure, unnecessary services - such as terminal services and SNMP - are running on most Windows machines. You've got to take care to shut down or firewall all unnecessary ports used by these services. * Passwords are revealed frequently. To defend against this, periodically change all passwords, including those that give access to Web services and databases. * Customized Web applications typically leak critical information. To defend against this, applications must be modified so they do not have commands that give too much information without proper authorization or let users modify objects out of turn. * Unmonitored services are dangerously open to attack. Watch your logs like a hawk. * Hack attacks happen. Be very, very afraid. Thayer is principal investigator with Canola & Jones, a security research firm in Mountain View, Calif. He can be reached at rodney(a)canola-jones.com. Acknowledgements Thanks to the Ghetto Hackers for running a great contest. They put together a complex game and made it run under very stressful conditions and it worked great. Thanks also to Sk3wl of R00t for letting me join in. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Brin is still a useful idiot
by Eugen Leitl 12 Aug '04

12 Aug '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Re: [osint] Al Qaeda's Travel Network
by Major Variola (ret) 11 Aug '04

11 Aug '04

>>Al Qaeda operatives rarely travel directly from Point A to Point B. Instead, they jump from country to country, with each destination having its own end use and with multiple stops between beginning and end.<< Hey, don't they know that onion-routing was patented by the Navy? Or that the mix network has prior art? If Alfred Queue has grokked traffic analysis, well its about time. All your Paki Inet Cafes are belong to us.

1 0

Insurer's In-Car Data-Gathering Draws Scrutiny
by R. A. Hettinga 11 Aug '04

11 Aug '04

<http://online.wsj.com/article_print/0,,SB109226203893889111,00.html> The Wall Street Journal August 12, 2004 AUTOS Insurer's In-Car Data-Gathering Draws Scrutiny By KATHY CHU DOW JONES NEWSWIRES August 12, 2004 A small test group of consumers will soon be able to save money on auto insurance -- if they give up some privacy on the road. Next week, Progressive Corp. of Mayfield Village, Ohio, will begin a pilot program in Minnesota to track how often, how far and how fast people drive. The insurer will provide as many as 5,000 volunteers with a matchbox-sized electronic device to be installed in their cars to gather this information. The incentive to sign up? Drivers get a guaranteed auto-insurance discount of 5%, and savings of as much as 25%, depending on their driving habits. The program -- though on a small scale and with no guarantee of being rolled out nationwide -- is being watched closely by consumer advocates, who are concerned about the privacy of drivers' information. This becomes more of an issue if these data are eventually gathered from more consumers in additional states. Progressive doesn't plan to share with others the information it collects, according to Dave Huber, a manager at the company. Also, drivers can view their information before deciding whether to submit it to Progressive, he said. Another reason why the insurer's move is getting attention: It follows a recommendation last week by the National Transportation Safety Board to put black boxes into new cars. The proposal came out of a hearing into a 2003 car accident in California. The purpose of these devices is to gather data at the time of an automobile crash to improve car and driver safety. The recommendation raises questions about who would have access to this information and whether consumers should be notified about this device. Many cars already have rudimentary devices that gather some crash information. Some auto makers, including General Motors Corp., have gone a step further, putting in sophisticated electronic contraptions to track data such as car speed and seat-belt usage in crashes where the air bag has been deployed. Whenever driver data are collected, the concern is that law enforcement or lawyers could try to summon this information during, respectively, investigations or civil lawsuits, according to Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit consumer-information program based in San Diego. "It may take a while for the privacy implications to become evident, but the main thing that individuals should be concerned about is the secondary use of that data," Ms. Givens said. For now, other insurers are watching Progressive's efforts. "We're always interested in finding methods of fine-tuning how we assess risk," said Dick Luedke, a spokesman for State Farm, one of the nation's largest auto insurers. In deciding whether to expand the current pilot program, Progressive will consider factors such as consumers' reactions to the devices and whether the company gets more customers. "We're hopeful all the while that this will allow us to attract safer drivers," Mr. Huber said. For some consumers, the financial benefits outweigh any privacy issues. Jacob Sevlie, 26 years old, was one of 250 drivers who accepted $25 to test out Progressive's device earlier this year, before it was offered to other consumers. Mr. Sevlie, who lives in Minneapolis, said he isn't concerned about the insurer knowing how fast and how often he is driving. "If it was tracking where I'm driving, that might be an issue, but how much I'm driving, that's not really private to me," said Mr. Sevlie, who hopes to get into the pilot program to get what he estimates will be a 15% discount on auto insurance. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

A Billion for Bin Laden
by R. A. Hettinga 11 Aug '04

11 Aug '04

<http://www.techcentralstation.com/080904D.html> Tech Central Station A Billion for Bin Laden By James Miller Published 08/09/2004 The $25 million reward the U.S. is offering for Bin Laden's capture just isn't enough. Sure, $25 million would induce a Pakistani peasant to turn in Bin Laden, but it's not enough to attract the financial markets to the Bin Laden hunt. With the possibility of earning a $1 billion bounty, however, professional Bin Laden hunting firms would form, allowing the U.S. to enlist the efficiency and creativity of the free market in our fight against Osama. The twentieth century's economic battles between capitalism and socialism proved that the private sector is far more effective than the government at providing services. Unfortunately, though, for many activities such as terrorist tracking, private companies have little incentive to engage. But a $1 billion bounty would motivate firms to join the hunt for Bin Laden. With a $1 billion reward in place, an international group of intelligence, military and terrorist experts that could credibly claim to have, say, at least a 5% chance of finding Bin Laden could easily raise $20 million or so from the financial markets to finance their search. With several such organizations unleashed on the mountains of Afghanistan and Pakistan, Osama's margin of safety would shrink. If my $1 billion free market experiment were implemented and proved successful, the U.S. could offer very large rewards for other international villains. Firms would then likely come into existence that specialized in capturing different types of criminals, some, for example, going after South American drug barons while others concentrated on Middle Eastern terrorists. I suspect that different sub-branches of the U.S. government currently compete for the resources necessary to find Bin Laden. Given how most public organizations operate, however, these resources probably go to the best bureaucratic infighters rather than those with the best chance of finding our murderous prey. The world's financial markets excel (at least compared with governments) at picking possible winners, so we should give them the power to determine who gets the capital needed to find Bin Laden. Those who think $1 billion is too much to pay for one sick man's capture should consider the deterrent effect of this bounty. Our government doesn't seem to shine at locating single individuals, so if they're willing to go into hiding, would-be terrorist master-sickos might not fear our wrath. But knowing that a large bounty would be placed on them might give pause to a few of our potential enemies. If the billion dollar bounty failed and Bin Laden ended up being located by the CIA or the U.S. armed forces rather than the private sector, the bounty wouldn't cost the taxpayers anything. But it still would have sent a powerful signal to our enemies that the massive wealth of the U.S. can be deployed against those who strike us. Many other nations don't seem to care very much about whether we catch Bin Laden and $25 million certainly isn't enough to change their priorities. But $1 billion would make a difference to nations like Pakistan and perhaps motivate them to search seriously for our main enemy. President Bush is reportedly ready to announce major new initiatives at his Republican Convention. A billion dollar Bin Laden bounty would make for the perfect convention proposal since it fuses Bush's dedication to tracking down the 9/11 instigator with a Republican faith in the free markets. James D. Miller writes The Game Theorist column for TCS and is a Republican Candidate for the Massachusetts State Senate. Editor's note: For other articles proposing free market solutions to practical problems see: An Anti-Terrorism Defense Fund Doing Well Against Spam By Taking Revenge Markets Reward Eco-Terror. So Lets Fix Them. Airport Security -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Michael Moore in Cambridge (download speech)
by Nomen Nescio 11 Aug '04

11 Aug '04

Very interesting speech by Michael Moore in Cambridge July 27, 10 MB http://hem.bredband.net/b114631/tillf/Michael_Moore_in_Cambridge_04072 7.rm The file will be available for download a short period of time. Michael shows us what the upcoming election is all about.

4 6

Privacy Showdown
by R. A. Hettinga 11 Aug '04

11 Aug '04

<http://www.forbes.com/2004/08/11/cz_ae_0811beltway_print.html> Forbes Business In The Beltway Privacy Showdown Ashlea Ebeling, 08.11.04, 6:00 AM ET The American Bankers Association, the Financial Services Roundtable and the Consumer Bankers Association have gone to the Ninth Circuit Court of Appeals to try to stop a California law that restricts how they can use customer information. The outcome of their appeal, filed Aug. 2, will decide the fate of the strictest state privacy law on the books, and the crucial issue of whether federal law preempts such state laws. Members of the three trade associations, such as Citigroup (nyse: C - news - people ), Bank of America (nyse: BAC - news - people ), Wells Fargo (nyse: WFC - news - people ) and Merrill Lynch (nyse: MER - news - people ), share customer information among their affiliates. Under the California Financial Information Privacy Act, commonly called SB1 after its bill number, they would have to either stop sharing among affiliates that are not in the same line of business (for example, a bank affiliate couldn't share with an insurance affiliate), or submit to the law's opt-out requirement. Under that rule, customers have the right to block, or opt-out, of the sharing of their information among affiliates. (A separate provision of the law requiring banks to get permission from customers before their information can be shared with third party companies is not under attack.) The bankers argue that the affiliate sharing restrictions are plainly preempted by the federal Fair Credit Reporting Act. But on June 30, Judge Morrison C. England Jr. of the U.S. District Court in Sacramento ruled that the FCRA, whose overriding purpose is to regulate the use and dissemination of consumer reports, does not preempt SB1. Instead, the judge said, the Gramm-Leach-Bliley Act, which sets forth basic privacy protections in non-credit reporting situations, is the relevant federal law and it does allow states to enact more stringent privacy controls. The California privacy law went into effect one day later on July 1. Financial institutions doing business in California now face penalties of up to $500,000 for negligent disclosure of nonpublic personal information, with no cap on what they can be fined for knowing and willful violations. Both state regulators and individual consumers can bring suit over alleged violations. On appeal, the industry groups argue that the district court incorrectly relied on the Gramm-Leach-Bliley Act, and that the FCRA, and 2003 amendments to it, expressly preempt SB1's affiliate sharing requirements. The state's reply brief is due September 1. "We think the district court got it right," says Susan Henrichsen, a California supervising deputy attorney general who is working on the case. Privacy advocates, including the Consumer Federation of California, Consumers Union and the Privacy Rights Clearinghouse, hope she's right. They spent years pushing for the law. California financial privacy legislation was introduced in 2000 and 2001, but died as industry lobbyists, and then-Gov. Gray Davis, worked to assure its defeat. California state Sen. Jackie Speier (D-San Francisco/San Mateo) introduced SB1 in December 2002. The industry groups spent $20 million trying to stop SB1, but eventually gave in, in light of an even graver threat. That threat came from a group called Californians for Privacy Now, organized and funded by E-Loan (nasdaq: EELN - news - people ) Chairman and Chief Executive Christian Larsen. It gathered 600,000 signatures for a ballot initiative that would have offered voters a chance to adopt even stricter privacy rules. For example, the initiative would have required companies to get permission before selling or sharing customer information, even among their own affiliates. With the passage of SB1, the group dropped its initiative drive. Gov. Davis too switched sides, and signed SB1 into law in August 2003. But industry groups apparently had other plans of attack to invalidate the affiliate sharing provisions of SB1: First, lobbying Congress to amend the FCRA, and second, suing in federal court. The fall 2003 amendments to the FCRA include a provision that broadens the law's preemptive scope--the bankers say this means the FCRA now preempts SB1. For now their battle is in the courts, but Congress may well be dragged into the privacy fight again. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Paul Kocher to Address Researchers at CHES 2004 Conference
by R. A. Hettinga 11 Aug '04

11 Aug '04

<http://biz.yahoo.com/prnews/040811/sfw036_1.html?printer=1> Yahoo! Finance Press Release Source: Cryptography Research, Inc. Paul Kocher to Address Researchers at CHES 2004 Conference Wednesday August 11, 8:03 am ET Security Expert Shares Insights on the Future of Applied Crypto SAN FRANCISCO, Aug. 11 /PRNewswire/ -- As the use of secure smartcards and other embedded systems continues to grow, the security and tamper resistance of these devices is becoming increasingly important, according to Paul Kocher, president and chief scientist at Cryptography Research, Inc. Kocher will discuss his vision of the challenges and solutions ahead for these systems at the upcoming Cryptographic Hardware and Embedded Systems (CHES) 2004 conference. Kocher will present his views at an invited lecture, "From Proof to Practice: Real-World Cryptography," at CHES, the world's leading research conference in applied tamper resistance, at 9:00 a.m. on Friday, August 13 at the Boston Marriott Cambridge Hotel. A pioneer in the field of differential power analysis (DPA) and countermeasures, Kocher will discuss the issues involved in building trustworthy cryptographic components that provide relying parties with "rational confidence" in security. "You need to have security that is both effective and that is verifiable by relying parties, since either one without the other is useless," Kocher explains. According to Kocher, one of the most difficult unsolved research problems in security and cryptography is to find effective ways to manage the risks created by the combination of human fallibility and the increasing complexity of modern security systems. "Traditional engineering approaches simply do not produce robust security," Kocher said. "At Cryptography Research, we've been learning to manage this problem by applying risk mitigation approaches from more established industries, such as aviation and medicine." Kocher's talk will describe some of these approaches and lessons, as well as open research problems where additional work is needed. About Paul Kocher Paul Kocher has gained an international reputation for his consulting work and academic research in cryptography. His research projects have included designing and co-authoring SSL v3.0, discovering timing attack cryptanalysis, and architecting the record-breaking DES Key Search machine, Deep Crack. At Cryptography Research, he led the team that discovered Differential Power Analysis, as well as the countermeasures for securing smart cards and other devices against these attacks. About Cryptography Research, Inc. Cryptography Research, Inc. provides consulting services and technology to solve complex security problems. In addition to security evaluation and applied engineering work, CRI is actively involved in long-term research in areas including tamper resistance, content protection, network security and financial services. The company has a broad portfolio of patents covering countermeasures to differential power analysis and other vulnerabilities, and is committed to helping companies produce secure smart cards and other tamper resistant devices. Security systems designed by Cryptography Research engineers annually protect more than $60 billion of commerce for wireless, telecommunications, financial, digital television and Internet industries. For additional information or to arrange a consultation with a member of the technical staff, please contact Jennifer Craft at 415-397-0123, ext. 329 or visit www.cryptography.com. Source: Cryptography Research, Inc. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[osint] Al Qaeda's Travel Network
by R. A. Hettinga 11 Aug '04

11 Aug '04

--- begin forwarded text To: osint(a)yahoogroups.com User-Agent: eGroups-EW/0.82 From: "gwen831" <DnNet628(a)netscape.net> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Wed, 11 Aug 2004 03:51:40 -0000 Subject: [osint] Al Qaeda's Travel Network Reply-To: osint(a)yahoogroups.com http://www.stratfor.com/free-scripts/comsite2.pl?page=BZdelivery&src_id=022… Al Qaeda's Travel Network August 10, 2004 Summary With the recent arrests of al Qaeda operatives in Pakistan, the United Kingdom and the United Arab Emirates, small clues as to the structure, organization, communication and travel of al Qaeda members are emerging. The most recent detentions have revealed a transportation link between Pakistan, England and the United States that allows for the movement of militants and messages, and relies on several other countries for waypoints and key supplies. Analysis A series of detentions of suspected al Qaeda members in Pakistan, England and the United Arab Emirates, as well as the arrests of persons of interest in the southern United States, have shed light on some of the ways that al Qaeda moves messages and militants around the globe. In particular, the small piece of the al Qaeda network recently rounded up illustrates transportation links between Pakistan -- where the core leadership of the organization appears to reside -- the United Kingdom and the United States. Al Qaeda operatives rarely travel directly from Point A to Point B. Instead, they jump from country to country, with each destination having its own end use and with multiple stops between beginning and end. This method of travel serves to obfuscate the origin and destination of al Qaeda messengers and operatives, reducing the likelihood that the militants will be captured or traced back to the organization's core. Despite the arrests of several senior al Qaeda members, including Abu Zubaydah, Ramzi bin al Shibh and Khalid Sheikh Mohammed, the whereabouts of Osama bin Laden remains a mystery. The core of al Qaeda's planning leadership appears to be in Pakistan, not far from its pre-9/11 Afghanistan base. Pakistan is both a resting and planning location and, in some cases, a target for al Qaeda, which used specific attacks against the regime of President Gen. Pervez Musharraf to try to wrest some space and leeway for continued residence inside the country. Al Qaeda is cautious to not escalate actions against Islamabad for fear of losing what appears to be the final sanctuary for the jihadist network's brain. But al Qaeda is an international organization, both in scope of vision and in distribution of operatives. Moving messages, equipment and personnel requires a relatively secure transportation network, one that can hide the true origin of travelers and thus slip in under the radar screen of intelligence and law enforcement agencies who are watching certain flight routes and looking for named and profiled potential militants. One key transit point is the United Arab Emirates. The UAE was one of only three countries to recognize the Taliban's rule in Afghanistan, and al Qaeda loyalists still reside in the country. Just a few days before their July 25 arrest alongside wanted al Qaeda leader Ahmed Khalfan Ghailani, two South Africans -- Dr. Feroz Ganchi and Zubair Ismail -- flew from UAE to Lahore, Pakistan. Another African, a Nigerian named Mohammed Salman Eisa, was captured at the Lahore airport on Aug. 2 while trying to board a plane bound for UAE. Eisa reportedly was carrying messages to operatives in other countries. The UAE provides an excellent transit point because safe houses, friendly sympathizers and money likely can be found. Though travel to and from Pakistan might garner suspicion, the UAE is a country thought to be without an active militant presence, and makes a good neutral stop between Pakistan and other nations. Should al Qaeda operatives obtain a UAE passport, they would receive significantly less scrutiny by the U.S. government, avoiding the standard profiling of certain passports, such as those from Pakistan and Saudi Arabia. Another node on the transit hub is Britain. As Stratfor has discussed, Britain is a good staging ground for planning attacks. A large Muslim, and especially Pakistani, community means those travelers can come and go without arousing much suspicion with travel authorities. Britain has a number of clerics and scholars willing to help "jihadic causes," both through their rhetoric and with operatives. Britain offers a fairly neutral stop between red-flag destinations. Mohammed Naeem Noor Khan, the suspected al Qaeda communications specialist at the center of the series of arrests, reportedly traveled often between Britain and Pakistan, using free plane tickets procured by his father, who worked for Pakistan's state-run airline. Abu Eisa al-Hindi -- a key al Qaeda operations manager believed to be responsible for much of the surveillance work done in the United States that led to the recent heightened terror alerts in parts of the country -- also traveled to the United States from Britain, allegedly as part of a three-man team that surveyed targets including the New York Stock Exchange in early 2001. South Africa also is becoming more and more prominent as a travel. Like the UAE, South Africa is not considered a hotbed of Islamist militancy -- aside, perhaps, from Johannesburg -- and therefore is less likely to raise suspicion as a possible al Qaeda source point. South Africa also provides a good source of fraudulent passports, papers and recruits for al Qaeda, and British citizens can travel freely to South Africa and back without a visa. With Muslims representing 2 percent of the population and large communities in Johannesburg and Pretoria, both money and potential recruits can be found there. Porous borders and easy access to weapons also make South Africa a dream come true for al Qaeda operatives. Crime syndicates operating inside the Department of Home Affairs reportedly have sold or given "boxes and boxes" of South African passports to al Qaeda members or their associates operating in Europe. In recent weeks three people -- one woman, Farida Goolam Ahmed and two unnamed men -- have been stopped in Mexico or the southern United States with suspicious South African passports -- often with pages missing. This reveals another key component to the al Qaeda travel network: the use of Mexico -- and likely Canada -- as key entry points into the United States. Mexico and Canada share large, and sometimes unguarded, borders with the United States. Ahmed's success in sneaking across the U.S.-Mexican border attests to the ease with which would-be terrorists could enter the United States. Ahmed, who had a South African passport with no U.S. entry stamp, was stopped at the airport in McAllen, Texas, and had with her an itinerary that showed her flying from Johannesburg to Dubai, then to London and finally to Mexico City, from whence she smuggled herself into Texas by simply forging through the brush. Canada also poses a problem. Its 4,000-mile border with the United States has one guard for every eight to 16 miles and has largely forested areas that are extremely difficult to patrol. As early as 1999, an Algerian named Ahmed Ressam was stopped in Washington state, en route from Canada, with more than 130 pounds of explosives in the trunk of his car. He had planned to blow up Los Angeles International Airport. The complexities of the transportation networks reveal al Qaeda's strengths and weaknesses. By moving through countries with a lower profile, at least as far as al Qaeda is concerned, operatives can mask their origins. Several of the foreign al Qaeda operatives in the past, like Jose Padilla, would declare their passports missing and get new ones issued while in more neutral countries, thus erasing all previous travel records. With a South African network of passports available, that becomes easier, and new passports can be used to register journeys that appear to begin far from their true origin. Although it is easier to move and hide using such a network, it also can be somewhat limiting: The revelation of the waypoint countries suddenly puts them higher on the suspicion list. Disruption of a key waypoint, then, also serves to force al Qaeda to try alternative, and perhaps less secure, routes. Ultimately, however, what we are seeing is only a small sliver of a larger transportation network -- one that spans the globe. But as slices of al Qaeda are cut away, more nodes in the transport and communication network will be revealed, forcing al Qaeda to react and change its methods again. That puts al Qaeda on the defensive, rather than the offensive. Copyrights 2004 - Strategic Forecasting, Inc. All rights reserved. ------------------------ Yahoo! Groups Sponsor --------------------~--> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar. Now with Pop-Up Blocker. Get it for free! http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0