February 2005 - cypherpunks-legacy

FSTC Project Update
by R.A. Hettinga 16 Feb '05

16 Feb '05

--- begin forwarded text

1 0

Re: SHA1 broken?
by R.A. Hettinga 16 Feb '05

16 Feb '05

--- begin forwarded text

1 0

RE: [p2p-hackers] SHA1 broken?
by R.A. Hettinga 16 Feb '05

16 Feb '05

--- begin forwarded text

2 1

Passwords? We don't need no stinking passwords
by R.A. Hettinga 16 Feb '05

16 Feb '05

<http://www.theregister.co.uk/2005/02/16/rsa_consumer_survey/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Original URL: http://www.theregister.co.uk/2005/02/16/rsa_consumer_survey/ Passwords? We don't need no stinking passwords By John Leyden (john.leyden at theregister.co.uk) Published Wednesday 16th February 2005 01:41 GMT RSA 2005 Concerns over online security are continuing to slow consumer e-commerce growth. A quarter of the respondents in a recent survey have reduced their online purchases in the past year and 21 per cent refuse to conduct business with their financial institutions online because of security fears. More than half (53 per cent) of the 1,000 consumers quizzed believe that basic passwords fail to provide sufficient protection for sensitive personal information. According to the RSA Security-sponsored telephone survey, poor management of PINs and passwords for access to online services, desktop computer systems, ATMs and other electronic accounts is a major vulnerability. As a major supplier of two-factor authentication products and services that offer an alternative to traditional static passwords, the issues raised by RSA Security's survey are more than a little self-serving. That doesn't mean its analysis is necessarily wrong, though. More and more security experts are lining up against the use of static passwords for e-banking; in part because the technique makes consumers easy prey for phishers. Even so, obituaries for the humble password may be premature. Adi Shamir, professor at Israel's Weizmann Institute of Science and noted cryptographer, said: "Passwords are not completely dead. For low level security apps they are still sufficiently good. It depends on the application". One PIN to rule them all More than two in three respondents (65 per cent) quizzed in RSA Security's survey use fewer than five passwords for all electronic information access and 15 percent use a single password for everything. These figures are unchanged from a similar survey last year. John Worrall, VP of worldwide marketing at RSA Security, said: "The majority of consumers are aware of the problems associated with passwords, but until they are presented with a reliable, easy-to-use alternative, they're going to continue to exhibit poor password management practices." . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Gates: security concerns propel IE7 launch
by R.A. Hettinga 16 Feb '05

16 Feb '05

<http://www.theregister.co.uk/2005/02/15/gates_rsa_2005/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Original URL: http://www.theregister.co.uk/2005/02/15/gates_rsa_2005/ Gates: security concerns propel IE7 launch By John Leyden (john.leyden at theregister.co.uk) Published Tuesday 15th February 2005 19:17 GMT RSA 2005 Information security concerns have prompted Microsoft to release a new version of Internet Explorer before the next version of Windows ships. Contrary to previous plans, Microsoft will release IE7 as a beta in "early summer" 2005. Longhorn, the next iteration of Windows, isdue late next year. Microsoft chairman Bill Gates today said IE7 will offer Windows XP SP2 advances in defending against phishing and malware but failed to go into any details. IE7 will also be included in Longhorn but its availability on other platforms remains unclear. In a keynote address at the RSA Conference in San Francisco, Gates singled out spyware and social engineering such as phishing and spyware attacks as the "fastest growing challenge". "There's no exploit involved," he said. "Social engineering attacks take the privilege of a user and fool them into running code they don't want to run." Microsoft has decided to make its Windows Anti-Spyware, released as a beta earlier this year and downloaded by 5m users, available at no extra charge to licensed Windows users, Gates announced. Microsoft also intends to introduce a consumer-focused anti-virus product by the end of the year. Gates repeatedly highlighted information security as a "top priority" for Microsoft. "It's the one thing we need to make sure that we get absolutely right to deliver the digital revolution," he said. Microsoft is spending $2bn of its $6bn research and development budget on security. Windows XP SP2 is a key building block in Microsoft's efforts to make its software more resistant to attack. More than 170m users have downloaded the product since its release late last year, Gates said. More users have applied the update after obtaining it on a CD. To make it easier for customers to apply patches, Microsoft intends to bring its separate Office and Windows Update services under one umbrella from March 2005. This service will be aimed at consumers and small businesses. Gates appeared relaxed during his 45-minute keynote as RSA, even cracking a decent joke. He produced a spoofed version of doodles he made at the recent World Economic Forum, which were mistaken by a UK paper (http://news.bbc.co.uk/1/hi/uk_politics/4220473.stm) for the jottings of Prime Minister Tony Blair. The spoof notes contained remarks such as "Why does Bill Clinton sit next to Angelina Jolie?" "Need cheeseburger" (a reference perhaps to Gates' expanding waistline) and his "password". -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

New Factor in Iraq: Irregular Brigades Fill Security Void
by R.A. Hettinga 16 Feb '05

16 Feb '05

<http://online.wsj.com/article_print/0,,SB110851686697056047,00.html> The Wall Street Journal February 16, 2005 PAGE ONE Bands of Brothers New Factor in Iraq: Irregular Brigades Fill Security Void Jailed by Hussein, Gen. Thavit Is Leading Thousands Now; Questions About Loyalty 'Toughest Force We've Got' By GREG JAFFE Staff Reporter of THE WALL STREET JOURNAL February 16, 2005; Page A1 BAGHDAD, Iraq -- In the battle against insurgents here, two kinds of Iraqi military forces are emerging: the planned units and the pop-ups. The planned units of the Iraq Army, about 57,000 soldiers strong, are the result of careful preparation this summer between the U.S. and Iraqi commanders. The pop-ups started to emerge last fall out of nowhere, catching the American military by surprise. These dozen disconnected units totaling as many as 15,000 soldiers are fast becoming one of the most significant developments in the new Iraq security situation. The unplanned units -- commanded by friends and relatives of cabinet officers and tribal sheiks -- go by names like the Defenders of Baghdad, the Special Police Commandos, the Defenders of Khadamiya and the Amarah Brigade. The new units generally have the backing of the Iraqi government and receive government funding. While regular units of the Iraq Army have taken up residence on rehabilitated army bases, the others camp out in places like looted Ministry of Defense buildings, a former women's college, an old Iraqi war monument and an abandoned aircraft hangar. Frequently, U.S. officials don't find out about them until they stumble across them. Some Americans consider them a welcome addition to the fight against the insurgency -- though others worry about the risks. "We don't call them militias. Militias are...illegal," says Maj. Chris Wales, who spent most of January tracking down and finding these new forces. "I've begun calling them 'Irregular Iraqi ministry-directed brigades.' " The "pop up" label comes from other U.S. military officials in Baghdad. Troops who might have otherwise joined the regular Iraqi Army are drawn to these units because they are often led by a particularly inspirational commander or made up of people with similar tribal and religious backgrounds. This makes the units more cohesive and potentially effective against the insurgency. "Just show us where to go and we will eat the insurgents alive," an Iraqi in one of these units told Maj. Wales earlier this month when he tracked them down at a long-shuttered Baghdad airport. Dangerous Uncertainty The bad news is that these new units can inject dangerous uncertainty and confusion into an already complex battlefield. On Election Day, the Special Police Commandos were rushing one of their wounded soldiers to the hospital when they accidentally ran into an Iraqi Army checkpoint. The Iraqi Army officers opened fire on the Commandos' black SUV, killing the three people in the car. 1 See complete coverage2 of The Fight for Iraq. Some U.S. officials worry about the new units' allegiances, which often seem split between their religious and tribal sponsors and the central government, creating the risk that the units could be used as militias if Iraq falls into civil war. U.S. military commanders in Baghdad are especially concerned about the Defenders of Khadamiya, which is forming to guard a major Shiite shrine on the city's northern edge at the behest of Shiite cleric Hussein al Sadr. U.S. military officials worry that the group, which now numbers about 120 men but plans to grow to more than 800, could be used to settle internal Shiite scores or deployed in a Sunni-Shiite conflict. As these irregular units proliferate, U.S. officials face a thorny dilemma: whether to encourage these forces, whose training and experience varies wildly, or to try to rein them in. "There is a tension between on the one hand encouraging and fostering initiative and on the other executing the plan for the Iraqi Security Forces that everyone agreed on," says Lt. Gen. David Petraeus, who is overseeing the massive U.S. effort to help train and equip Iraqi military units. "To be candid, I would err on the side of fostering initiative. I want to get the hell out of here." The first of these military units, the Special Police Commandos, was formed in September by Gen. Adnan Thavit, the uncle of Iraq's interim interior minister. The unit started with about 1,000 soldiers. When Col. James Coffman, a senior aide to Gen. Petraeus, found them they were occupying a heavily damaged Republican Guard base a few miles from the U.S. embassy. "It was basically 1,000 guys at the time living in a bombed-out building with no electricity, no plumbing and no bathrooms," the colonel says. Col. Coffman, however, was struck by the unit's arms room, which was stocked with rocket-propelled-grenade launchers, mortar tubes and lots of ammunition. "The weapons were clean and organized," he says. He immediately went on a patrol with the unit and was impressed by both Gen. Thavit and his troops. The soldiers seemed to have a discipline that many of the U.S.-trained Iraqi Army units lacked. The 63-year-old Gen. Thavit, an intelligence officer in the old Iraqi Air Force, attended military academies in the former Soviet Union and former Yugoslavia. In the mid-1990s he joined a small group of former officers plotting to overthrow Saddam Hussein. In 1996 their plan unraveled and Gen. Thavit was sentenced to life in Iraq's notorious Abu Ghraib prison. Gen. Thavit and his second-in-command, Maj. Gen. Rashid Flayeh Mohammed, were both released by Mr. Hussein along with thousands of other political prisoners and common criminals just before the American invasion. One of Gen. Thavit's former jailers, who gave him food and cigarettes, is now a battalion commander in his new force. The Second Defenders of Baghdad Brigade On Col. Coffman's recommendation, Gen. Petraeus visited the Commandos' base and was impressed with the troops. "When I saw them and where they were living I decided this was a horse to back," the U.S. general says today. He agreed to give the fledgling unit money to fix up its base and buy vehicles, ammunition, radios and more weapons. Unlike many of the U.S.-trained Army units, the Commandos, whose ranks today include several thousand soldiers, have had few deserters. In early January, insurgents crashed a car bomb into the gate of the unit's base, killing six Iraqi recruits who hoped to join the Commandos and injuring dozens more. Some of the injured went to the hospital, got bandaged up and then returned to the base that afternoon still eager to join. Forty-three Special Police Commandos have been killed in battles with insurgents since September and about 300 have been wounded, U.S. officials say. Part of the reason that the unit inspires such allegiance is that all of their recruits are hand-selected by Gen. Thavit and Gen. Mohammed. By contrast, most Iraqis who join the regular Iraqi Army are recruited at a half-dozen joint U.S.-Iraqi-run recruiting stations and lack the cohesive bond and pride that grows out of being handpicked. "The reason the Commandos are special is that a couple of great leaders at the top have just flat out put their imprint on that organization," says Gen. Petraeus. Some U.S. military officials, however, worry that the Commandos' allegiance is as much to their leader as it is to the Iraqi government. "If you tried to replace Gen. [Thavit] he'd take his...brigades with him. He is a very powerful figure. You wouldn't get that from other units," says Col. Dean Franklin, a senior officer in Gen. Petraeus's command. "Pound for pound, though, they are the toughest force we've got." Gen. Thavit says that his only goal is to defend the democratically elected Iraqi government against insurgents and criminals. "I could see that the police were not able to withstand the terrorists. As a professional soldier I believed it was my duty to help build a force that could work against the terrorists," he says. "I am an old man right now. I should be retired." In late November with the Iraqi elections approaching, homegrown units similar to the Commandos began popping up all over Baghdad. First came the Muthana Brigade, a unit formed by the order of Iraqi Prime Minister Ayad Allawi. It set down roots at a long-abandoned airport in downtown Baghdad. Like the Commandos, the unit appeared to be well-trained and was pressed quickly into service. "They went from not even existing to being as viable as any Iraqi Army unit out there in six weeks," says Col. Franklin. The Defenders of Baghdad, a far less disciplined unit made up of Baghdad Shiites, emerged in early January. The unit took up residence around Baghdad's Martyr's Monument, which commemorates Iraqis who died in the war with Iran. A few days later Maj. Wales, ordered in December to track the units, located the Amarah Brigade in a bombed-out former Ministry of Defense building. The U.S. Army's First Cavalry Division had been renovating the building for an Iraqi National Guard unit, but the Amarah brigade pushed the contractors out. The leader of the ragtag group of solders claimed to be a cousin of the Iraqi defense minister and said the minister's tribe had purchased the cooking equipment the troops were using to survive, according to Maj. Wales's report on the group. Over the next three weeks, Maj. Wales says, he tracked down five other new Iraqi units -- most of them from Shiite-dominated southern Iraq. For a week no new units popped up on his radar. Then on Jan. 30, the day before the Iraqi elections, Maj. Wales got a tip via his boss, Gen. Petraeus, that a new 2,000-man force calling itself the Second Defenders of Baghdad Brigade had formed somewhere in the city under the command of an Iraqi general named "Faris." But Maj. Wales's usual American and Iraqi sources had never heard of the unit -- or the general. "There are no generals named Faris in the Iraqi Army," one senior Iraqi general in the Ministry of Defense told him. Maj. Wales began to think Gen. Petraeus had been passed a bad tip. "There is no way in the world there could be a Second Defenders of Baghdad Brigade," Maj. Wales said. "It is just impossible. There is no place in Baghdad left to put them." Maj. Wales made a few more calls to U.S. liaison officers working with the Iraqis and turned up nothing. Finally, he got in touch with Gen. Babakir Zebari, Iraq's top general, who said the brigade had recently moved into tents and a hangar bay at Baghdad's long-abandoned Muthana Airport. On Feb. 1, Maj. Wales and a small team of American officers set out to find them. After about 15 minutes of searching the airport grounds, they found the brigade. About half of them were in civilian clothes. The other half wore new Iraqi Army uniforms. All of the men seemed to be from one or two Shiite-dominated towns in southern Iraq. Many said they were vetted by Sheik Ali Shalan of the Al Shamer tribe in southern Iraq. "I joined this unit as an expression of my love for my country," said Wathiq Rahim, a skinny young recruit from Hilla who was clad in a black Christian Dior T-shirt and rubber sandals. A short while later, Maj. Gen. Fouad Faris, the commander of the brigade, drove up in a white SUV. A small round man who trained at Sandhurst, the British military academy, Gen. Faris said there were 1,300 men at the airport under his command and an additional 1,500 on the way. "I am very close to the minister of defense, which is why he chose me for this mission," Gen. Faris said. The Americans later confirmed his account with top Iraqi military officials. It wasn't clear, however, what the troops were going to do. Initially the brigade was supposed to help guard election polling places, but they arrived in Baghdad two days too late. "I was just yelling at the men for not arriving here in time for the elections," he explained. Now the general suggested that his troops might be asked to guard the Green Zone, where the U.S. embassy is based. In the near term, he needed to find someplace better to house the men and set up a brigade headquarters. "This is not a good situation here," he told Maj. Wales. "It is much too crowded." The unit that has generated the most concern among American military officials is the Defenders of Khadamiya, the unit forming in northern Baghdad to guard the Shiite shrine. There is good reason for the unit. The shrine at Khadamiya draws some 800,000 Shiite pilgrims each year and poses an attractive target for Sunni terrorists like Abu Musab al-Zarqawi eager to set off a Sunni-Shiite civil war. But some U.S. military officials worry it could be used in internecine battles between rival Shiite clerics. Because the Defenders of Khadamiya force appears so closely aligned with prominent Shiite cleric Hussein al Sadr, some U.S. officers worry that other Shiite clerics might use the unit to justify forming their own unauthorized militias. In particular radical Shiite cleric Muqtada al Sadr might try to revive his Mahdi militia, which U.S. troops battled in Najaf and Sadr city this summer. Some senior officers in Gen. Petraeus's command have suggested the Americans ask the Iraqis to consolidate all the new units in Baghdad under a single division headquarters, putting them more firmly under the control of the central government and making it easier for U.S. forces to coordinate with them. But there are limits to U.S. influence. "There is no way we can stop the Iraqis from doing something they want to do. This is their country and their army now," says Lt. Col. James Bullion who works for Gen. Petraeus. "We can't put that genie back in the bottle." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [p2p-hackers] SHA1 broken?
by R.A. Hettinga 16 Feb '05

16 Feb '05

--- begin forwarded text

1 0

California Wants GPS Tracking Device in Every Car
by Eugen Leitl 16 Feb '05

16 Feb '05

Link: http://slashdot.org/article.pl?sid=05/02/15/201217 Posted by: Zonk, on 2005-02-15 20:48:00 from the now-this-is-a-good-use-of-engineering dept. [1]HTS Member writes "California has a new excuse for more taxes. Claiming losses due to fuel-efficient cars, such as Gasoline/Electric Hybrids, California is cooking-up a new system to punish people who aren't using enough gasoline. They want to [2]tax commuters by the mile. How would this be accomplished? By requiring everyone to install a GPS device in their vehicle, and charge them their "taxes" every time they fuel-up. From the article: 'Drivers will get charged for how many miles they use the roads, and it's as simple as that.. [a] team at Oregon State University equipped a test car with a global positioning device to keep track of its mileage. Eventually, every car would need one.'" References 1. http://www.hackthissite.org/ 2. http://www.cbsnews.com/stories/2005/02/14/eveningnews/main674120.shtml ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[i2p] weekly status notes [feb 15] (fwd from jrandom@i2p.net)
by Eugen Leitl 15 Feb '05

15 Feb '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

'Trustworthy' Computing Now Gates' Focus
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://news.yahoo.com/news?tmpl=story&cid=562&u=/ap/20050215/ap_on_hi_te/se…> Yahoo! 'Trustworthy' Computing Now Gates' Focus 1 hour, 21 minutes ago By MATTHEW FORDAHL, AP Technology Writer SAN JOSE, Calif. - Microsoft Corp. co-founder Bill Gates (news - web sites) is expected to give his perspective Tuesday on computer security and provide an update on the software giant's efforts to make computing more "trustworthy." He will speak to an estimated 11,000 security experts gathered for the weeklong RSA Conference, sponsored by RSA Security Inc., based in Bedford, Mass. In the three years since Microsoft launched its initiative to improve the security of its products, the company has changed how its software is written, improved the mechanism for fixing bugs and released some tools for removing virtual pests. So far, results have been mixed. While there have been no major attacks in recent months, the number of worms and viruses continues to grow and other headaches - such as spam, spyware and adware - are multiplying and quickly becoming security threats themselves. Most still target Microsoft Windows, the world's dominant operating system. Since Gates (now the company's chairman and chief software architect) spoke at the RSA Conference in 2004, Microsoft has issued a major security upgrade to Windows XP (news - web sites) aimed at blocking malicious code and protecting users from downloading programs that might carry a virus, worm or other unwanted program. The company also has recently started releasing programs that remove a limited number of worms and other pests. It's also giving away an early version of Microsoft AntiSpyware, a program that removes unwanted programs and helps protect new ones from being installed. But so far it's remained mum on when it will jump into the antivirus software business and directly compete against companies that sell programs designed to shore up Windows. Microsoft declined to comment in advance of the speech. "It may be something of a natural evolution for them, although ironic given that it's a majority of their software is what they're having to protect," said Vincent Gullotto, vice president of McAfee's Antivirus and Vulnerability Emergency Response Team. "While they're building software to protect their software, they're also building their software to be secure," he added. "It should prove to be some interesting times." Meanwhile, Microsoft continues to be a target. Last week, a "Trojan horse" program was detected that attempts to shut down its antispyware program as well as steal online banking passwords. "This particular attempt appears to be the first by any piece of malware to disable Microsoft AntiSpyware, but it may be the first of many such future attacks," said Gregg Mastoras, senior security analyst at Sophos PLC, a security firm. Meanwhile, other security software vendors aren't standing still. Symantec, for instance, has unveiled a new version of its corporate computer security software that promises not only to remove traditional viruses and worms but also adware and spyware. The updated programs are expected to be available next month. "Customers are looking for spyware and adware protection from their antivirus vendor, a partner they trust," said Brian Foster, Symantec's senior director of product management for client and host security. McAfee Inc., another antivirus company, also is putting a greater focus on spyware and adware with its McAfee Anti-Spyware Enterprise for corporations. It will be available March 2. McAfee also is announcing that it will send out updates of its virus definitions on a daily, rather than weekly basis. The new program starts Feb. 24 for its corporate clients. The more frequent updates will be available for its retail software in about three months, Gullotto said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0