January 2005 - cypherpunks-legacy

[ISN] SSL VPNs Will Grow 54% A Year, Become Defacto Access Standard: Report
by InfoSec News 07 Jan '05

07 Jan '05

http://www.informationweek.com/story/showArticle.jhtml;jsessionid=NIOHIDQYV… By Matthew Friedman Networking Pipeline Jan. 5, 2005 Spending on Secure Sockets Layer Virtual Private Networks (SSL VPN) will grow at a 53% compound annual growth rate, and SSL VPNs will surpass traditional IPsec VPNs as the de-facto remote access security standard by 2008, according to a new report from Forrester Research. In "SSL VPNs Poised for Significant Growth," Forrester associate analyst Robert Whiteley says companies are attracted by the technology's application-level simplicity. Unlike IPsec VPNs, which require special client software to access the network, SSL VPN supports a wide range of devices, from desktop computers to PDAs, and applications, while offering network administrators greater granularity of user information and providing better endpoint security. According to the report, some 44% of American businesses have deployed SSL VPNs, spending $97 million on the technology last year alone. Despite the impressive adoption rate for a technology that has been in the business mainstream for less than a year, Forrester expects SSL VPN deployments to continue to take off, with the market growing at a 53% compound annual growth rate to $1.2 billion in 2004. SSL VPNs are already well-entrenched in the financial and business services industries and in the public sector. Driven by the need to ensure endpoint security for online services, the financial services industry can boast a 56% penetration rate, with business services just behind at 51%. In both cases, Whiteley predicts a compound annual growth of 34% to 2010 which, though impressive, pales beside the expected SSL VPN growth in late-adopting industries. Indeed, Whiteley writes that retail and manufacturing are poised to leap into SSL VPN with gusto over the next few years. "Retail and wholesale allocates 7.8% of its IT spend to security more than even financial services," he notes. "This vertical shows the most SSL VPN potential because of its eye toward security, relatively little penetration to date, and the need for large, distributed deployments resulting in 82% annual market growth through 2010." Though only 29% of manufacturers are currently invested in SSL VPNs, Whitely expects that to change dramatically through 2010, predicting a phenomenal 94% compound annual growth rate. IPSec was a poor fit for this vertical's needs, Whiteley observes, but the application-layer flexibility of SSL VPNs should spur rapid adoption. "Manufacturing companies typically don't provide employees with corporate-managed laptops," he writes. "Thus, SSL VPNs allows a 'bring-your-own computer' model where manufacturing companies still control security and user policy but don't have to incur the cost of unnecessary IT infrastructure." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] SSL VPNs Will Grow 54% A Year, Become Defacto Access Standard: Report
by InfoSec News 07 Jan '05

07 Jan '05

http://www.informationweek.com/story/showArticle.jhtml;jsessionid=NIOHIDQYV… By Matthew Friedman Networking Pipeline Jan. 5, 2005 Spending on Secure Sockets Layer Virtual Private Networks (SSL VPN) will grow at a 53% compound annual growth rate, and SSL VPNs will surpass traditional IPsec VPNs as the de-facto remote access security standard by 2008, according to a new report from Forrester Research. In "SSL VPNs Poised for Significant Growth," Forrester associate analyst Robert Whiteley says companies are attracted by the technology's application-level simplicity. Unlike IPsec VPNs, which require special client software to access the network, SSL VPN supports a wide range of devices, from desktop computers to PDAs, and applications, while offering network administrators greater granularity of user information and providing better endpoint security. According to the report, some 44% of American businesses have deployed SSL VPNs, spending $97 million on the technology last year alone. Despite the impressive adoption rate for a technology that has been in the business mainstream for less than a year, Forrester expects SSL VPN deployments to continue to take off, with the market growing at a 53% compound annual growth rate to $1.2 billion in 2004. SSL VPNs are already well-entrenched in the financial and business services industries and in the public sector. Driven by the need to ensure endpoint security for online services, the financial services industry can boast a 56% penetration rate, with business services just behind at 51%. In both cases, Whiteley predicts a compound annual growth of 34% to 2010 which, though impressive, pales beside the expected SSL VPN growth in late-adopting industries. Indeed, Whiteley writes that retail and manufacturing are poised to leap into SSL VPN with gusto over the next few years. "Retail and wholesale allocates 7.8% of its IT spend to security more than even financial services," he notes. "This vertical shows the most SSL VPN potential because of its eye toward security, relatively little penetration to date, and the need for large, distributed deployments resulting in 82% annual market growth through 2010." Though only 29% of manufacturers are currently invested in SSL VPNs, Whitely expects that to change dramatically through 2010, predicting a phenomenal 94% compound annual growth rate. IPSec was a poor fit for this vertical's needs, Whiteley observes, but the application-layer flexibility of SSL VPNs should spur rapid adoption. "Manufacturing companies typically don't provide employees with corporate-managed laptops," he writes. "Thus, SSL VPNs allows a 'bring-your-own computer' model where manufacturing companies still control security and user policy but don't have to incur the cost of unnecessary IT infrastructure." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[fc-announce] FC05 registration to open next week
by R.A. Hettinga 07 Jan '05

07 Jan '05

--- begin forwarded text User-Agent: Microsoft-Entourage/11.1.0.040913 From: "Stuart E. Schechter" <ses(a)ll.mit.edu> To: <fc-announce(a)ifca.ai> Subject: [fc-announce] FC05 registration to open next week Sender: fc-announce-admin(a)ifca.ai Date: Fri, 07 Jan 2005 11:00:54 -0500 Registration for Financial Cryptography and Data Security 2005 will open early next week. My apologies for the delays and thanks for your patience. In the meantime, please do make sure that you've made all your other travel arrangements (flight/hotel/car rental). For more information, see http://fc05.ifca.ai/travel.html Please don't hesitate to get in touch if there's any further information that I can provide you. Best regards Stuart Schechter General Chair Financial Cryptography and Data Security 2005 _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] SSL VPNs Will Grow 54% A Year, Become Defacto Access Standard: Report
by R.A. Hettinga 07 Jan '05

07 Jan '05

--- begin forwarded text

1 0

Clean Money, Dirty Conscience: Are some Americans guilty of banking while Muslim?
by R.A. Hettinga 06 Jan '05

06 Jan '05

<http://www.reason.com/links/links122804.shtml> Reason magazine December 28, 2004 Clean Money, Dirty Conscience Are some Americans guilty of banking while Muslim? Jeff Taylor The headline grabbing quirkiness of Yasser Arafat's investment in the American bowling industry demonstrates that true global connectedness remains a scary thing. Such financial scorekeeping-whose money, what money, where-is a pointless exercise in an age when funds can circle the Earth in a second and mutate several times along the trip. The clean money, dirty money, blood money obsession would be quaint were it not for the tremendous burden the pursuit of money laundering places on innocent people just trying to enjoy the immense benefits of a modern financial system. The PATRIOT Act's veil of secrecy is beginning to bite in this regard without any evidence that the United States is made safer in the bargain. Some Middle Eastern-surnamed individuals in the U.S. now report an unwillingness on the part of some banks to do business with them based on government money laundering/anti-terror regulations. In fact, while other parts of the PATRIOT Act initially drew fire, Section 314 glided by, largely overlooked by everyone except the bankers. As it turns out, Section 314 is a ticking time-bomb for anyone a buttoned-down banker might consider suspicious. This section requires banks and other federal regulated financial institutions to comply with government requests for information on customers. As with other parts of PATRIOT, Section 314 built upon other long-standing federal bank regs, allowing PATRIOT boosters to use their tired Officer Barbrady "this is nothing out of the unusual" defense of the provision. But Section 314 anticipated and sanctioned a much larger number of information requests in a much shorter period of time, increasing the cost of compliance to banks. Indeed, the initial crush of information requests from the government in September 2002 was so great that the banks won a temporary suspension of the requests. Banks thought they had a much firmer grasp of what to do with Section 314 requests when they resumed in February 2003. However, the catch remained that banks are supposed to comply with Section 314 requests quickly and accurately, divulging no information to anyone about them, and then promptly forget all about the requests. In particular, if an information request for a Joe Terror comes in, and Podunk Bank has no records of a Joe Terror as a customer, the law directs Podunk Bank to do nothing. This practice does avoid flooding the reporting system with replies that say, "yes, we have no Joe Terror," but leaves Podunk Bank with the queasy feeling that it responded to federal regulators by doing nothing. This is not in the nature of bankers. If the feds dropped in, particularly a suit from the criminal section of the Treasury Department, and suggested a change in the color of the balloons in the lobby, there would not be a whole lot of discussion as to why. Banks comply; that is why they are banks. So rather than risk the wrath of regulators, banks very quickly hit upon the idea of keeping names submitted on Section 314 requests on their do-not-do-business-with lists. All banks have them and the lists are perfectly legal. After all, some customers-bad credit risks, chronic check bouncers-may just be more trouble than they are worth. Putting 314-requested names on the list would at least create a paper trail should the feds someday request one and remove a troublesome class of customer from bank rolls to boot. This brings us to the question of the day: Has Section 314 made all Muslim-surnamed customers, or even more broadly, those of Middle Eastern descent in general, more trouble than they are worth to American banks? The American Civil Liberties Union says it has dozens of complaints involving financial institutions denying services to Muslims. A recent case involves a Mississippi man who was suddenly told by his bank that his account had been closed. No explanation was given for the action. Interestingly, however, the bank, AmSouth, recently was fined $40 million by the Treasury for failure to comply with reporting regulations involving money laundering. It is certainly true that the more Middle Eastern names a bank has on record, the more likely it is to be forced to complete Section 314 information requests. The more requests you get, the more likely you are to screw one up and get walloped with a fine. Why not lighten that load and reduce that risk by cutting back on "trigger" names? The logic is undeniable. The banks, of course, would never admit to such a practice, and regulators point to official directions not to use Section 314 requests as a guidepost to a customer's desirability as a client. But this language simply ignores reality, and the reality is that the law has set up a powerful incentive to keep Muslims outside the mainstream financial services sector. Maybe that outcome does not trouble the 44 percent of Americans who say in a poll that they favor restrictions on the civil liberties of Muslims in the U.S. However, it guarantees that some law-abiding Muslims will face frustrating hurdles to living their lives as everyday Americans. And that is troubling to anyone who values freedom and real, lasting security. Jeff Taylor writes the weekly Reason Express. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DIMACS Workshop on Information Markets, NJ Feb 2-4 2005
by R.A. Hettinga 06 Jan '05

06 Jan '05

--- begin forwarded text

1 0

[i2p] 0.4.2.6 is available (fwd from jrandom@i2p.net)
by Eugen Leitl 06 Jan '05

06 Jan '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Spaf's mailing list on information assurance/security, cybercrime
by Bill Stewart 06 Jan '05

06 Jan '05

------ Forwarded Message From: Gene Spafford <spaf(a)cerias.purdue.edu> Date: Wed, 05 Jan 2005 15:06:18 -0500 To: <dave(a)farber.net> Subject: mailing list announcement for IP I have created the mailing list "ias-opportunities(a)cerias.purdue.edu" for distributing announcements of funding opportunities, conference and journal calls, and similar solicitations specifically about issues of information assurance, information security, and cybercrime-related issues. This is not limited to academics -- these announcements should be of interest as well to people in government and industry. Members of the list can send announcements such as the above to the list. Non-members can send announcements to "ias-opportunities-submit(a)cerias.purdue.edu" for posting. If you are interested in subscribing to the list, send email to "ias-opportunities-request(a)cerias.purdue.edu" with the message subscribe If you want to subscribe an address other than the one from which you send the email, use the message subscribe <other-email> This list is for announcements only -- not discussions, and should be low-volume. A WWW-archive of posts is available at <http://www.cerias.purdue.edu/homes/spaf/ias-opportunities/>. Cheers, --spaf ------ End of Forwarded Message

1 0

Re: sitting ducks
by Trei, Peter 06 Jan '05

06 Jan '05

Major Variola (ret) wrote: > > At 12:16 PM 1/4/05 -0500, John Kelsey wrote: > >Interesting questions: How hard is it for someone to actually > hit an airplane with a rifle bullet? How often do airplane > maintenance people notice bulletholes? > > > >My understanding is that a single bullethole in a plane > is not likely to do anything serious to its operation--the > hole isn't big enough to depressurize the cabin of a big > plane, and unless it hits some critical bits of the plane, > it's not going to cause mechanical problems. > FWIW Recall that a few 'copters have been taken down with > AK fire, though the birds/round is likely low. And copters > are more delicate than a multi-engined fixed wing. It appears that the Iraqi resistance fighters figured out that of several of them simultaneously fire full-auto AK's in front of a chopper flying overhead, sometimes they'll get lucky. Of course, these are low, slow targets. We're discussing a terrorist trying to take out a commercial jet with a 50 BMG, right? Even at takeoff, a passenger jet is moving at 150-200 mph, a *lot* faster than a clay pigeon, or the choppers the Iraqis hit. > Hitting the cabin would be pretty effective though. And > certain parts of big planes are vital, perhaps moreso > on fly by wire Airbus planes. I understand that there is redundancy in the critical components. Hitting the pilot AND copilot at takeoff would probably be effective, but you've got one (1) shot before its out of range, and its moving fast. A tracer into a fuel tank may also be effective. > A homemade mortar through the roof of your van > (IRA style) onto a stationary, taxiing plane > would be pretty spectacular, sitting ducks... > lots of cameras... easy getaway or > repeat fire.. But that's not the 50 BMG scenario. The most effective way to use the 50 BMG would probably be to hit an engine intake rotor while the jet is still on the ground, starting its takeoff roll. This probably won't kill anyone, but would have a big economic impact as people decided not to fly. ...but that's still a damn difficult shot. The target is moving, the bullet has non-trivial flight time (well over a second at long range). Getting a first shot hit is highly improbable. All in all, the 50 BMG vs jet scenario is just plain bogus. > Of course the BMG crap is all about eroding > rights, not reality. I honestly don't think that many politicians wake up in the morning and think to themselves 'What rights can I erode today?'. I think it's more 'what can I do that will make me *look* good?' . It doesn't matter if their action is actually effective, it matters that it makes them appear to be 'doing something' and makes for a good 5 second sound bite. 50 BMG rifles are used, very rarely, for hunting. For an example, see: http://www.fcsa.org/articles/1994-1/elk_hunt.html More people are into very long range (1000 yard and up) target shooting. Those are the only 'legitimate' civilian reasons to use a 50 BMG. It's like owning a McLaren F1 - you can't use it much, but its very, very, cool. As a result, it's difficult for most people to come up with a justification to own one beyond 'because it's very, very cool'. [I'm deliberately leaving aside the 2A rights issue (which in a better world would be then end of the argument) since it doesn't seem to get much traction with most politicians or sheeple any more]. 50BMG rifles look very, very, tactical. I've never seen one with a walnut stock. They are the canonical 'scary looking gun'. So, the politician sees a type of gun: * Which theoreticly could be used to do Very Bad Things. * Owned by a group of people too small to be significant voting block. * For which its difficult to come up with a practical use. * Which looks very photogenicly scary. ...and he or she thinks 'Wow, a lot of people will feel safer it I ban these, and I can make them think I'm protecting them. Also, getting on TV with one of these is a great visual.' Actual reality doesnt enter it. Peter Trei

1 0

Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire
by R.A. Hettinga 06 Jan '05

06 Jan '05

Ah... Book-entry to the trigger. The ganglia, as the man said, twitch. Whole new meaning to digital "rights" management. Cheers, RAH ------- <http://www.nytimes.com/2005/01/06/technology/circuits/06next.html?ei=5090&e…> The New York Times January 6, 2005 WHAT'S NEXT Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire By ANNE EISENBERG HE computer circuits that control hand-held music players, cellphones and organizers may soon be in a new location: inside electronically controlled guns. Researchers at the New Jersey Institute of Technology in Newark are building a handgun designed to fire only when its circuitry and software recognize the grip of an authorized shooter. Sensors in the handle measure the pressure the hand exerts as it squeezes the trigger. Then algorithms check the shooter's grip with stored, authorized patterns to give the go-ahead. "We can build a brain inside the gun," said Timothy N. Chang, a professor of electrical engineering at the New Jersey Institute of Technology who devised the hardware for the grip-recognition system. "The technology is becoming so cheap that we can have not just a computer in every home, but a computer in every gun." The main function of the system is to distinguish a legitimate shooter from, for example, a child who comes upon a handgun in a drawer. Electronics within the gun could one day include Global Positioning System receivers, accelerometers and other devices that could record the time and direction of gunfire and help reconstruct events in a crime investigation. For a decade, researchers at many labs have been working on so-called smart or personalized handguns designed to prevent accidents. These use fingerprint scanners to recognize authorized shooters, or require the shooter to wear a small token on the hand that wirelessly transmits an unlocking code to the weapon. At the New Jersey Institute of Technology, Michael L. Recce, an associate professor in the department of information systems, decided instead to concentrate on the shooter's characteristic grip. Dr. Recce created the software that does the pattern recognition for the gun. Typically, it takes one-tenth of a second to pull a trigger, Dr. Recce said. While that is a short period, it is long enough for a computer to match the patterns and process the authorization. To bring Dr. Recce's recognition software to life, Dr. Chang created several generations of circuits using off-the-shelf electronic components. He equipped the grips of real and fake handguns with sensors that could generate a charge proportional to the pressure put on them. The pressure on the grip and trigger are read during the beginning of the trigger pull. The signals are sent to an analog-to-digital converter so that they can be handled by the digital signal processor. Patterns of different users can be stored, and the gun programmed to allow one or more shooters. At first the group worked mainly with a simulated shooting range designed for police training. "You can't have guns in a university lab," Dr. Recce said. The computer analysis of hand-pressure patterns showed that one person's grip could be distinguished from another's. "A person grasps a tennis racket or a pen or golf club in an individual, consistent way," he said. "That's what we're counting on." During the past year, the team has moved from simulators to tests with live ammunition and real semiautomatic handguns fitted with pressure sensors in the grip. For five months, five officers from the institute's campus police force have been trying out the weaponry at a Bayonne firing range. "We've been going once a month since June," said Mark J. Cyr, a sergeant in the campus police. "I use a regular 9-millimeter Beretta weapon that fires like any other weapon; it doesn't feel any different." For now, a computer cord tethers the gun to a laptop that houses the circuitry and pattern-recognition software. In the next three months, though, Dr. Chang said, the circuits would move from the laptop into the magazine of the gun. "All the digital signal processing will be built right in," he said. Michael Tocci, a captain in the Bayonne Police Department, recently saw a demonstration of the technology. One shooter was authorized, Captain Tocci said. When this person pulled the trigger, a green light flashed. "But when other officers picked up the gun to fire, the computer flashed red to register that they weren't authorized," he said. The system had a 90 percent recognition rate, said Donald H. Sebastian, senior vice president for research and development at the institute. "That's better fidelity than we expected with 16 sensors in the grip," Dr. Sebastian said. "But we'll be adding more sensors, and that rate will improve." Dr. Chang said the grip for the wireless system would have 32 pressure sensors. "Now, in the worst case, the system fails in one out of 10 cases," he said. "But we've already seen that with the new sensor array, the recognition is much higher." Dr. Sebastian said the team was considering adding palm recognition as a backup. To develop a future weapon, the university is working with a ballistics research and development company, Metal Storm, of Arlington, Va. "We'll use our recognition system on their weapons platform," Dr. Sebastian said. The Metal Storm gun has plenty of room for the pattern-recognition circuitry. Rounds are kept in the gun's barrel, not in a magazine in the grip. There is a small amount of the gun's own electronic circuitry in the handle to control the firing, said Arthur Schatz, senior vice president for operations at the company. "Otherwise it's pretty much empty, allowing the grip system to be housed within the handle," he said. Captain Tocci of the Bayonne Police Department said the pattern-recognition technology was promising, particularly because accidental deaths occur when guns are not safely stored. "If a child picks up a gun that is not secured, this way it can't be fired," he said. Guns taken from a home during a robbery would be rendered useless, too. "The premise the gun is based on has credibility," he said. When people see a live demonstration of the pattern-recognition system working, he said, "you think, yes, this is possible." E-mail: Eisenberg(a)nytimes.com Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0