August 2004 - cypherpunks-legacy

[e-gold-list] An interesting technology for cashlike tokens.
by R. A. Hettinga 16 Aug '04

16 Aug '04

And James makes the next step. The online gold systems, like goldmoney and e-gold, certainly have an enormously cheaper cost of entry than trying to plug into, say, the ATM system. Cheers, RAH --- begin forwarded text

1 0

Israelis voting for Bush defeated Gore
by Major Variola (ret) 16 Aug '04

16 Aug '04

Contrary to widespread belief, it was more likely American voters in Israel, not Florida, who put George W. Bush in the White House four years ago a phenomenon that has Kerry's supporters in Israel vowing to do whatever it takes to make certain that doesn't happen again in November. Those who doubt that Americans living abroad could tip the balance in 2004 might consider this: Various chads aside, Al Gore (news - web sites) received 202 more votes than George W. Bush on Election Day 2000 in Florida. Only after all the overseas votes were counted, including more than 12,000 from Israel alone, was Bush's election victory certified. The margin was 537 votes. ... But in the 2000 presidential election, Zober points out, it made no difference how Israeli immigrants from New York voted. All that mattered was how expatriates from Florida cast their ballots. Israel is home to roughly 6,000 former Floridians expatriates who tend to be more conservative than Jewish voters in New York and many of whom voted for Bush in the last election, Zober said. http://news.yahoo.com/news?tmpl=story&u=/ap/20040815/ap_on_el_ge/election_t…

2 1

Children of criminals to be 'targeted' and 'tracked'
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://news.independent.co.uk/low_res/story.jsp?story=551894&host=3&dir=62> The Independent Children of criminals to be 'targeted' and 'tracked' By Marie Woolf ,Chief Political Correspondent 16 August 2004 Children of criminals to be 'targeted' and 'tracked' Hazel Blears: Shedding new light on the old cops-and-robbers story Bruce Anderson: Blunkett and Howard are right to focus on the collapse of order and rising crime? Children of criminals are to be "targeted" and "tracked" from an early age by the Government to prevent them following their parents into a life of crime, as part of a campaign to tackle the next generation of offenders. In an offensive on youth crime, a programme to prevent 125,000 children whose fathers are in prison from joining them in jail, is being planned by the Home Office. In an interview with The Independent, Hazel Blears, the Policing minister, says she is optimistic that "tracking" and "targeting" can help prevent children becoming criminals like their parents. Studies showed that children with criminal fathers and "under-achievers" who grow up in local authority care have a significant chance of turning to crime themselves. "About 125,000 kids have got a dad in prison. That's a huge risk factor. Something like 65 per cent of those kids will end up in prison themselves," she said. "We need to track the children who are most at risk. We can predict the risk factors that will lead a child into offending behaviour." However, she is aware the plan, based on research showing children of criminals are far more likely to end up in jail than their peers, may lead to accusations they are being unfairly singled out. "I don't think it is stigmatising those children by targeting them," she said. "You can intervene at an early age and say 'your life can be different and we will help you and your parents make your life different.' Let's put the support in as early as we can." The Policing minister has been in talks with Margaret Hodge, the minister for Children, about an early intervention scheme to prevent children of burglars, muggers, and gangsters from breaking the law. She wants to use methods used in Labour's Sure Start programme for under-fives in deprived areas to give extra support to children from criminal backgrounds. Children would be tracked by the authorities from the time they are in nappies to their teenage years with extra support and help to nip disruptive behaviour in the bud. One study showed that the most violent offenders began to display bad behaviour as young as six. Another study which tracked children into adult life found "under-controlled" children who exhibited disruptive behaviour at the age of three were four times more likely to be convicted of violent offences. "If you can tackle the 125,000 kids with dads in jail by providing extra support and help there's a chance," Ms Blears said. Teenagers with criminal fathers would be monitored and offered extra support at school and by social services as well as being introduced to sport, drama and other after-school activities. "You can get the parents into parenting classes. We can get some of the older kids involved in arts, sports drama. Give them something to succeed at. If you go to school every day and everybody tells you you are rubbish you are never going to succeed," she said. Ms Blears also wants to see a crackdown on violence and bullying in schools. Studies show classroom bullies are more likely to be involved in muggings, car theft and attacks outside school. "I don't think you can afford to let it go. It's a bit like zero tolerance," she said. The judicial system should help offenders, including drug addicts who rob to fuel their habit, to change their ways. But if they refuse to change, the police should provide a "hostile environment" for them. "We will help you change your life but if you want to go back to robbing we will be on your doorstep," she said. Meanwhile, children up to the age of five are to be kept in prison with their mothers at Cornton Vale, near Stirling, it emerged yesterday. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Trust no one: backdoored CPUs
by Major Variola (ret) 16 Aug '04

16 Aug '04

We worried about compromized OSes, BIOSes, read last week about a PNG library bug that lets images run buffer exploits, now CPUs can be backdoored: >From Scheier's Crypto-gram: Here's an interesting hardware security vulnerability. Turns out that it's possible to update the AMD K8 processor (Athlon64 or Opteron) microcode. And, get this, there's no authentication check. So it's possible that an attacker who has access to a machine can backdoor the CPU. <http://www.realworldtech.com/forums/index.cfm?action=detail&PostNum=252 7&Thread=1&entryID=35446&roomID=11> or <http://tinyurl.com/43kod>

2 1

The New Digital Media: You Might Have It, But Not Really Own It
by R. A. Hettinga 16 Aug '04

16 Aug '04

Anyone who knows about cryptography quickly comes to the conclusion that if it's encrypted, and I have the key it's *my* property. It doesn't matter what the lawyers say -- or even the guys they hire with guns at your friendly local geographic force monopoly. :-). Now if we can figure out a way to pay for that property cheap enough that nobody *cares* who owns it, as long as they get paid... Cheers, RAH ------- <http://online.wsj.com/article_print/0,,SB109260940215891895,00.html> The Wall Street Journal August 16, 2004 PORTALS The New Digital Media: You Might Have It, But Not Really Own It By NICK WINGFIELD Staff Reporter of THE WALL STREET JOURNAL August 16, 2004 Buying music used to be simple: You coughed up $14 or so for a CD, and as long as you didn't bootleg it or charge crowds of people to listen to it, the music was yours. The Internet and other technologies are changing all that, opening up a slew of new options for purchasing entertainment, be it music or movies or games. That's a good thing. The not-so-good thing is that in the next few years, the sheer number and complexity of those new options are likely to bewilder many consumers. You may no longer be able to "own a movie" or "own a CD," at least in the sense those phrases have been used. Instead, you will merely have "rights" to the content, enforced by technology. Those rights might change over time, even at the whim of the music or movie company you get them from. The technology allowing all this is called digital-rights management, or DRM. It's a kind of invisible software lock securely bolted onto a song or movie. Being software, it's a very flexible sort of lock. A music label, for example, might let you download a song free and then listen to it for a day, but then require you to pay up to keep on listening. For a taste of what DRM might bring, check out Apple Computer's iTunes Music Store, which sells songs for 99 cents. ITunes comes with a DRM system that prevents customers from playing those songs on more than five computers, or burning more than seven identical lists of songs onto CDs. (Before you can play a song on a sixth computer, you need to use the DRM software to "de-authorize" it from one of the first five machines.) Of course, no such technical limits exist on normal music CDs, though recording companies, especially in Europe, are experimenting with restrictions. Some iTunes users are grumbling. In June, science-fiction writer Cory Doctorow gave a talk critical of DRM technology in which he related how he hit Apple's limit on the number of computers he could play his music on -- three machines at the time. One computer was in the shop, another was at his parents' house and a third was a defective machine he had returned to Apple -- without first remembering to de-authorize his music on it so he could play it on another machine. As a result, Mr. Doctorow said he was unable to listen to hundreds of dollars worth of music. Apple says such problems aren't common, especially since the company upped its computer limit to five in April. But that change itself was a lesson in the power of DRM: Apple's increase was retroactive, and applied to all songs, not just those purchased after the change took effect. In this case, Apple gave users more liberal rights. (It also curbed some types of CD burning, but the change didn't apply to previously purchased music.) However, there's nothing preventing Apple from making its DRM retroactively more restrictive -- though the company says that's unlikely. Apple set up the iTunes DRM as a way of getting the big labels -- badly burned by the original Napster -- comfortable with music online. It deserves credit for helping legalize digital music: iTunes has had more than 100 million downloads. And even with the restrictions, iTunes customers more or less "own" their music once they've bought it. By contrast, consumers only "rent" music at subscription services like RealNetworks's Rhapsody, which typically charge a $10 or so monthly fee for playing as much music as customers want. The catch: Rhapsody subscribers can play their songs only on their PCs, not portable audio players, and only as long as they keep paying their monthly bills. That's the main reason these "rental" sites haven't done as well as iTunes. (By the end of this year, a new version of Microsoft's DRM will allow subscription users to transfer content to portable players.) It's not just Internet music that's getting more complicated. Most of today's movie DVDs contain restrictions that prevent users from copying them, or playing them in a different geographic region from where they are bought. But Hollywood studios, along with technology and consumer electronic companies, are working on a new generation of DVDs that will, in addition to holding more data for high-definition movies, also have a much more flexible DRM. As a result, different studios might end up imposing different DVD restrictions. You may, for instance, be able to make a copy of the "Toy Story 4" DVD for your laptop -- but not do the same thing with "Charlie's Angels 5." Those variations will likely require some form of labeling on DVDs so consumers will know what they're getting, according to companies involved in planning them. Alan Davidson, associate director of the civil liberties group Center for Democracy and Technology, says he isn't opposed to DRM, but worries consumers may not understand what rights come with content they purchase. "DRM underscores the point that consumers are going to have to become a lot more sophisticated about what they're buying," he says. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cyberspace Gives Al Qaeda Refuge
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://news.yahoo.com/news?tmpl=story&cid=2026&u=/latimests/20040815/ts_lat…> Yahoo! Cyberspace Gives Al Qaeda Refuge Sun Aug 15, 7:55 AM ET By Douglas Frantz, Josh Meyer and Richard B. Schmitt Times Staff Writers ISTANBUL, Turkey - In December, Al Qaeda operatives posted a manifesto on the Internet calling for attacks inside countries allied with the United States in Iraq (news - web sites). Spain, with elections approaching, was singled out as a target. On March 11, terrorists set off bombs on four commuter trains in Madrid and killed 191 people. Three days later, Spanish voters replaced the pro-war government with a party whose leader had promised to withdraw the country's 1,300 troops from Iraq. The posting of the strategy and the timing of the Madrid bombings shocked even the most hardened Al Qaeda watchers recently when they reviewed the little-known manifesto. "It's quite extraordinary in that you have a group of people talking about influencing a political process and then having it happen," said a U.S. national security official who analyzed the 54-page posting and spoke on condition that his name not be used. "Reading through this thing, it is just mind-blowing." Since Osama bin Laden (news - web sites) and his followers were driven from their bases in Afghanistan (news - web sites), the Al Qaeda terrorist network has demonstrated an increasing ability to exploit the Internet as it reconfigures itself as a semi-leaderless global extremist movement far more elusive than the original incarnation. Websites run by Al Qaeda and its backers have become virtual classrooms for terrorists, offering instructions for activities such as kidnapping and using cellphones to set off bombs, like the ones used in Madrid. Independent Al Qaeda cells and the network's loose hierarchy use easily available encoding programs and simple techniques to exchange virtually undetectable messages between Internet cafes in Karachi and libraries in London. The Internet's importance to Al Qaeda was highlighted this month by the disclosure that Pakistani authorities had apprehended Mohammed Naeem Noor Khan, a suspected Al Qaeda computer engineer, and collected a wealth of electronic material. E-mail and other information from Khan's computers led to the arrests of 13 suspects in Britain and sent investigators scrambling to unravel electronic links among militants in Pakistan, Europe and the United States, British, U.S., and Pakistani authorities said. The discovery of files on financial institutions in New York and Washington among Khan's trove also played a role in prompting the Bush administration to issue a terrorist warning. Although it has long been known that Al Qaeda used the Internet to conduct reconnaissance on potential U.S. targets, the disks and hard drives taken from Khan disclose much about the resiliency and adaptability of a far-flung network hiding in plain sight, said U.S. and foreign intelligence officials and outside experts interviewed for this report. "The Internet allows the organization to become a virtual self-perpetuating and changing entity in cyberspace that provides technological guidance and moral inspiration to a new generation," said Magnus Ranstorp, a counter-terrorism expert at the University of St. Andrews in Scotland. Rather than the computer whizzes often described by government officials and the press, the Al Qaeda operatives are more often people with everyday skills who have harnessed the Internet in a campaign against the United States and its allies. Even Khan, whom senior U.S. officials describe as extremely computer savvy, used skills available to many people with computer training. Over time, they developed and shared techniques to avoid detection. An Al Qaeda survival manual warned adherents not to use the same Internet cafe too many times. Messages should be written on a word processor and pasted into an e-mail to avoid keeping the computer connected to the Internet for too long, it said. The result is a changing definition not only of Al Qaeda but also of the threat from what is known as cyber-terrorism. After Sept. 11, the biggest fear of terrorists using the Internet was their potential to disable air traffic control systems or disrupt the electric power grid of the United States. Billions were spent shoring up infrastructure defense. Although those concerns remain, authorities said no incident of cyber-terrorism has been recorded and worries have receded. Instead, the discovery of the December manifesto, the arrest in Pakistan last month and the accumulation of other evidence are leading to recognition that for now, at least, cyberspace is not a weapon for Al Qaeda, but a tool - one more difficult to counter than gunmen huddled in caves and tents. James Lewis, director of technology policy at the Center for Strategic and International Studies in Washington, said one clear advantage for Al Qaeda is that the Internet gives it a communications system that rivals that of a superpower without the accompanying risk. "There is no central headquarters," he said. "There is no central place you can knock out." U.S. and foreign authorities interviewed in recent days generally agreed with a report last spring by the U.S. Treasury and Justice departments, which concluded that the Internet poses tough challenges "because it is largely anonymous, geographically unbounded, unregulated and decentralized." Al Qaeda is not a newcomer to the Internet. In 2000, the group hacked into the e-mail and bank accounts of a U.S. diplomat in Saudi Arabia as part of an effort to track his movements and plot an assassination attempt, which was later abandoned, Ranstorp and a security official in the region said. In the final stages of planning the Sept. 11 attacks, hijacker Mohamed Atta sent a coded message over the Internet that said: "The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering." After the Sept. 11 attacks on the World Trade Center and Pentagon (news - web sites), the camps and safe houses in Afghanistan where Atta and his accomplices had once trained were destroyed in the U.S. air assaults. Thousands of Al Qaeda adherents fled to hiding places in the tribal areas along the Afghan-Pakistani border, to Pakistan and to dozens of other countries. They left behind computers with files on how to build nuclear bombs, diagrams of U.S. buildings and software for stealing passwords off the Internet. In the months that followed, key leaders were killed or captured. Bin Laden has remained so deeply hidden that most intelligence officials think he no longer exercises much control over the network. The U.S. and its allies worked with some success to shut down the flow of money to Al Qaeda through Saudi charities, wealthy benefactors and other means. Faced with this multi-pronged assault, Al Qaeda reinvented itself, with a new reliance on the Internet. Manuals from the training camps were posted on websites. Praise for the "holy war" and appeals for money to continue the fight started popping up. Information was shared among members, and alliances with local and regional extremist groups were formed through cyberspace. More recent Internet postings reflected the adaptations of the new Al Qaeda, with its independent cells and new, often untrained recruits scattered throughout the Middle East, Europe and Africa. In late May, a website linked to Al Qaeda in Saudi Arabia published detailed instructions for carrying out a kidnapping. Three weeks later, U.S. aerospace engineer Paul M. Johnson Jr. was kidnapped in Riyadh, the Saudi capital, and later beheaded. Saudi extremists have proved particularly adept at using the Internet to communicate with other Al Qaeda groups and to promote their aim to topple the royal family, security officials in the country said. But the posting that called for attacks on U.S. allies in Iraq - and its chilling effectiveness - has proved the most startling. "It shows that they are very strategic in what they are doing," the U.S. national security official said. The document was posted on a website run out of the Middle East. Its language, religious references and other telltale signs convinced U.S. experts that an Al Qaeda member wrote it, though they have not identified the author. Titled "Jihad in Iraq: Hopes and Dangers," the posting advocated attacking countries aligned with the U.S. that were most vulnerable to pressure to withdraw their troops from Iraq. Italy and Spain were singled out, with a special mention of Spain's approaching elections. "Withdrawal of Spanish or Italian forces would put immense pressure on the British presence in a way that Tony Blair (news - web sites) might not be able to bear," it said in one of several paragraphs underlined for emphasis. "In this way the dominoes will begin to fall quickly." At another point, the posting said, "We think that the Spanish government could not tolerate more than two, maximum three blows, after which it will have to withdraw as a result of popular pressure." The posting was available on one of the hundreds of Arabic-language websites that cater to extremists and moderates alike. Many of them are watched by intelligence and law enforcement agencies, but experts say there are far too many to monitor thoroughly. Evan Kohlmann, a Washington-based terrorism analyst who has been a consultant to the U.S. government, said he was monitoring an Internet chat room frequented by Islamic extremists last month when someone posted copies of the complete Windows desktop of a U.S. soldier serving in South Korea (news - web sites). The soldier had apparently installed a program to access his work computer through another computer and the hacker found a back door and took control of the machine by using simple techniques, Kohlmann said. Simplicity seems to work best. One common method of communicating over the Internet is essentially an e-mail version of the classic dead drop. Members of a cell are all given the same prearranged username and password for an e-mail account on an Internet service provider, or ISP, such as Hotmail or Yahoo, according to the recent joint report by the Treasury and Justice departments. One member writes a message, but instead of sending it, he puts it in the "draft" file and then logs off. Someone else can then sign onto the account using the same username and password, read the draft and then delete it. "Because the draft was never sent, the ISP does not retain a copy of it and there is no record of it traversing the Internet - it never went anywhere, its recipients came to it," the report said. Secure messages also can be transmitted using widely available encryption tools. Slightly more advanced methods allow messages to be embedded in image, sound or other files transferred over the Internet through a process called "steganography." The files cannot be distinguished without a decoding tool. The difficulty of intercepting and deciphering messages has given rise to a game of cyber cat and mouse, according to government and independent experts. In an effort to gather information on potential recruits and donors, U.S. law enforcement agencies operate websites that are set up to resemble extremist Islamic sites. Visitors leave an electronic trail when they enter the site. On the other side, Al Qaeda can transmit false information to determine whether its members are being monitored by law enforcement. The Internet offers stealth to its users, but authorities can get valuable information if they can get their hands on data stored in computers or on disks. U.S. and foreign investigators still are sifting through the material taken from Khan. By cross-referencing the data with old files on people, places and methods of attacks, they hope to get a new picture of the organization's operations and identify its operatives, senior U.S. law enforcement officials say. They also are getting a closer look at the role of the Internet in Al Qaeda's strategies - and a rare chance to turn the tables on the organization's computer prowess. "Al Qaeda relies on the Internet just like everyone else, and increasingly more so," a senior Justice Department (news - web sites) official said. "But that reliance could also come back to bite them." (BEGIN TEXT OF INFOBOX) Background: Mohammed Naeem Noor Khan Mohammed Naeem Noor Khan, right, a suspected Al Qaeda computer expert, was arrested July 15 in Pakistan. Khan reportedly has told his FBI (news - web sites) interrogators that the terrorist network has monitored top U.S. political officials so closely that its operatives know where they live and the names of their neighbors. Authorities believe Khan may have been a key link among Al Qaeda cells in Pakistan, Britain and the United States. He was arrested while uploading information to several Al Qaeda-affiliated websites at an Internet cafe in Karachi. He reportedly was in the process of sending an e-mail death threat to President Bush (news - web sites), claiming that it was from Al Qaeda. - Los Angeles Times -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

MSNBC - Terrorism: Leads From a Laptop
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://www.msnbc.msn.com/id/5709166/site/newsweek/print/1/displaymode/1098/> MSNBC.com Terrorism: Leads From a Laptop Newsweek Aug. 23 issue - As frightening as the recent terror warnings about attacks on the homeland have been, U.S. intelligence officials are still stumped by one key question: did any of the plots represent live threats or had Al Qaeda shelved the plans long ago? Raids in Pakistan and Britain over the past few weeks led to a windfall of intelligence about terrorist cells, operations and tradecraft. The major bonanza was a computer and related gear seized from captured Qaeda fixer Muhammed Neem Noor Khan-who, U.S. officials tell NEWSWEEK, was in at least indirect contact with Osama bin Laden. It was from Khan's computer disks that the Feds learned about plans to attack major financial targets in New York and Washington. But intel officials also revealed that the operatives cased the potential targets more than three years ago, suggesting the plot may not have been active. What they have not disclosed, NEWSWEEK has learned, was intelligence that strongly suggested terrorists were actively planning to strike somewhere in Britain. Sources say Khan and Babar Ahmad, a cousin in London who ran pro-bin Laden Web sites, had recently exchanged messages about such an operation. The plotters apparently researched numerous targets, but none in depth, suggesting they had not made any final decision or that, in the words of a senior U.S. law-enforcement official, "They were very flexible." (The method of attack is unclear.) Sources close to the case say that Ahmad-who was arrested by British authorities on a U.S. extradition warrant earlier this month-recently quit his job and moved to sell his house in South London, possibly in preparation for leaving the country. (Ahmad's lawyers failed to respond to requests for comment.) A British official acknowledged that authorities were aware of possible plots but said "there is no specific identification of targets-either individuals or locations." British authorities have spent nearly two weeks questioning several other suspects, one of whom is Esa al-Hindi, the high-level Qaeda operative who is believed to have written some of the surveillance reports of financial buildings in New York and Washington that were found in Khan's computer. U.S. officials say al-Hindi is the author of a jihad recruitment book published in Birmingham, England, which describes him as a Hindu convert who once served as an instructor in an Afghan training camp. A representative of the publisher told NEWSWEEK he met al-Hindi once, and that he was short and spoke with a London accent. U.S. officials, NEWSWEEK has learned, have photos of al-Hindi that they are eager to make public and show to employees in the cased buildings, hoping to jog memories, especially about possible accomplices. But they have so far been blocked from doing so by British authorities who say such premature publicity could blow their case. British law requires that al-Hindi and other suspects be released or charged early this week-at which time the photos are likely to be released. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cyber Fears On Fed's Web Plan
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://www.nypost.com/business/18671.htm> The New York Post CYBER FEARS ON FED'S WEB PLAN By HILARY KRAMER Email Archives Print Reprint August 15, 2004 -- With little fanfare, the Federal Reserve will begin transferring the nation's money supply over an Internet-based system this month - a move critics say could open the U.S.'s banking system to cyber threats. The Fed moves about $1.8 trillion a day on a closed, stand-alone computer network. But soon it will switch to a system called FedLine Advantage, a Web-based technology. Proponents say the system is more efficient and flexible. The current system is outdated, using DOS - Microsoft's predecessor to the Windows operating system. But security experts say the threat of outside access is too big a risk. "The Fed is now going to be vulnerable in two distinct ways. A hacker could break in to the Fed's network and have full access to the system, or a hacker might not have complete access but enough to cause a denial or disruptions of service," said George Kurtz, co-author of "Hacking Exposed" and CEO of Foundstone, an Internet security company. "If a security breach strikes the very heart of the financial world and money stops moving around, then our financial system will literally start to collapse and chaos will ensue." FedLine is expected to move massive amounts of money. Currently, Fedwire transfers large-dollar payments averaging $3.5 million per transaction among Federal Reserve offices, financial institutions and federal government agencies. Patti Lorenzen, a spokeswoman for the Federal Reserve, said the agency is taking every precaution. "Of course, we will not discuss the specifics of our security measures for obvious reasons," she said. "We feel confident that this system adheres to the highest standards of security. Without disclosing the specifics, it is important to note that our security controls include authentication, encryption, firewalls, intru sion detection and Federal Reserve conducted reviews." Ron Gula, president of Tenable Network Security and a specialist in government cyber security, said he's sure the Fed is taking every precaution. But no system is 100 percent foolproof. "If the motive was to manipulate the money transferring, there are Tom Clancy scenarios where there are ways to subvert underlying technologies," Gula said. "For example, a malicious programmer can put something in the Fed's network to cause the system to self-destruct or to wire them money." The biggest concern isn't the 13-year-old who hacks into the Fedwire and sends himself some money - it's terrorism. On July 22, the Department of Homeland Security released an internal report saying a cyber attack could result in "widespread disruption of essential services ... damag(ing) our economy and put(ting) public safety at risk." But the Fed's undertaking of this massive overhaul is considered a necessity. "Our strategy is to move to Web-based technology because there are inherent limitations with DOS based technology and our goal is to provide better and robust product offerings to meet our customers' needs," said Laura Hughes, vice president of national marketing at the Chicago Fed, which has spearheaded this program. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

How to Find Osama
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text

1 0

RPOW - Reusable Proofs of Work
by hal＠finney.org 15 Aug '04

15 Aug '04

I'd like to invite members of this list to try out my new hashcash-based server, rpow.net. This system receives hashcash as a Proof of Work (POW) token, and in exchange creates RSA-signed tokens which I call Reusable Proof of Work (RPOW) tokens. RPOWs can then be transferred from person to person and exchanged for new RPOWs at each step. Each RPOW or POW token can only be used once but since it gives birth to a new one, it is as though the same token can be handed from person to person. Because RPOWs are only created from equal-value POWs or RPOWs, they are as rare and "valuable" as the hashcash that was used to create them. But they are reusable, unlike hashcash. The new concept in the server is the security model. The RPOW server is running on a high-security processor card, the IBM 4758 Secure Cryptographic Coprocessor, validated to FIPS-140 level 4. This card has the capability to deliver a signed attestation of the software configuration on the board, which any (sufficiently motivated) user can verify against the published source code of the system. This lets everyone see that the system has no back doors and will only create RPOW tokens when supplied with POW/RPOW tokens of equal value. This is what creates trust in RPOWs as actually embodying their claimed values, the knowledge that they were in fact created based on an equal value POW (hashcash) token. I have a lot more information about the system at rpow.net, along with downloadable source code. There is also a crude web interface which lets you exchange POWs for RPOWs without downloading the client. This system is in early beta right now so I'd appreciate any feedback if anyone has a chance to try it out. Please keep in mind that if there are problems I may need to reload the server code, which will invalidate any RPOW tokens which people have previously created. So don't go too crazy hoarding up RPOWs quite yet. Thanks very much - Hal Finney

1 0