February 2005 - cypherpunks-legacy

Nigerians turn to vigilantes
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://news.bbc.co.uk/2/low/africa/4265415.stm> The BBC Tuesday, 15 February, 2005, 12:38 GMT Nigerians turn to vigilantes By Sola Odunfa BBC Africa Live, Lagos Not so long ago, mangled bodies or charred remains of mob justice victims littered the streets of Lagos, Nigeria's largest city. Health workers could hardly cope with removing the bodies immediately. Many of the victims died in agony from burning tyre necklaces and others were either stoned or beaten to death. Now, there are many fewer such gruesome deaths because well-organised vigilante groups have scared many robbers away. The police were overwhelmed by the sheer number of the criminals. In frustration and anger the public decided to take the law into their hands in self-protection. Mob justice became popular in Nigeria during the years of military rule when violent personal crimes rose uncontrollably. "How is your community dealing with crime? " Gangs of young men armed with guns and pick-axes rampaged the streets night and day, robbing people with violence. Rape was a common feature in most robberies. Security committees Frightened by the growing crime rate, the public responded by setting up neighbourhood watch or market security committees who, in turn, engaged vigilantes. "When armed men broke into my residence five years ago. They did terrible things to my wife and children." Anonymous civil servant They were well paid and armed with locally-made guns and charms. The vigilantes usually live in the neighbourhoods they protect; they know the "bad boys" there. They will usually send word to suspects to leave the area or face their wrath. If their warning is not heeded, they are known to mount midnight raids on the suspects' hideout. The result is often brutal death. A civil servant who sought anonymity for fear of reprisal, says no robber should be spared. "When armed men broke into my residence five years ago. They did terrible things to my wife and children." "I have not recovered from that psychological wound. Since then I have been joining any mob anywhere to deal with any robbers caught. They don't deserve to live," he says. Popular support Nowadays, most of the killings are carried out by vigilante groups set up by communities and market traders' groups. The activities of the vigilantes are not supported by the police but not much is done to curb them because they seem to enjoy popular support. In Lagos, the best known of the vigilantes are members of the Odua Peoples Congress (OPC). They have a reputation for being ruthless in dealing with suspected criminals and being incorruptible. Despite being outlawed by President Olusegun Obasanjo four years ago, the OPC continues to enjoy a large measure of public support, not only in Lagos but all over south-west Nigeria. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Paradigms for Paranoids
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.theregister.co.uk/2005/02/14/codecon_paradigm_for_paranoids/prin…> The Register Biting the hand that feeds IT The Register ; Software ; Developer ; Paradigms for Paranoids By Team Register (feedback at theregister.co.uk) Published Monday 14th February 2005 22:15 GMT Codecon 2005 The fourth annual CodeCon - "a workshop for developers of real-world applications that support individual liberties" - convened Friday afternoon (11 Feb) at Club NV (envy, not Nevada), amid ghostly laptop panels hovering in violet-tinted danceclub murk. First-day registrations reached a respectable 90 (at $80 each), with more expected as the weekend progresses. The highlight among the first day's five presentations was Ian Goldberg and Nikita Borisov on Off-the-Record Messaging (http://www.cypherpunks.ca/otr/) (OTR), where 'messaging' can be instant messaging in any of its various formats, including online games, and "off the record" is meant to emulate as closely as possible the realworld strategy of sneaking off somewhere private, where you can talk with absolutely no record of what you said that might come back later to haunt you. (I was reminded of Maxwell Smart's ill-omened Cone of Silence.) Conventional crypto technologies are optimised for (e.g.) enduring longterm contracts, but OTR prefers that messages be written as if in sand, via "perfect forward secrecy" (PFS) and "repudiable authentication". (Even if your conversation is cracked and transcribed, the programmers have included a "forgery toolkit" that allows you to repudiate such transcripts as trivial to forge.) With such glorious levels of intimate distrust, I was surprised Ian didn't name his exemplary chatterers "Bill" and "Monica" - both Ian and Nikita were witty presenters, with the former doing funny voices, and the latter offering, when a projector bulb blew during their demo, to substitute an interpretive dance. Another maniacally brilliant twist is that they can invisibly solicit OTR dialogs from strangers in chat by appending an inconspicuous all-whitespace flag, consisting of a characteristic arrangement of 24 spaces and tabs. And it was a pleasure, as well, to hear the consistently high level of followup questions after their talk. Other first-day presentations: Hal Finney on digital cash ("The owner of the server is the enemy"), David Reid and Ben Laurie of Apache on adding group-based access controls to the certification process, Walter Landry's exhaustive comparative benchmarking of distributed version-control apps (due to be posted here (http://www.nongnu.org/arx/)) and Cat Okita on reputation management. See the schedule (http://www.codecon.org/2005/schedule.html) and program (http://www.codecon.org/2005/program.html) for details. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

How to isolate DNA with salad-spinner
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.theregister.co.uk/2005/02/14/codecon_2005/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Original URL: http://www.theregister.co.uk/2005/02/14/codecon_2005/ How to isolate DNA with salad-spinner By Jorn Barger (feedback at theregister.co.uk) Published Monday 14th February 2005 16:25 GMT CodeCon 2005 For sheer hackerly exuberance, the best-received presentation at CodeCon 2005 was the closer by Dan Kaminsky of Doxpara (http://doxpara.com/) showing the progress he's made on his DNS exploit OzymanDNS since he presented it at Defcon last August. At that time he offered to archive Knoppix across 35,000 DNS caches by posting, to each cache, 80 records of 256 bytes each - he's now simplified that to something more like five records of 4k each. It's still untraceable, unblockable by firewalls, and allows effectively unlimited simultaneous downloads, with the download speed limited primarily by how fast your system can run his Perl script. He calls this extremely versatile new trick "Fragile Router Protocol" and warns security mavens they're going to have to start hustling to have any hope of keeping up. The flashiest demo of the day was Incoherence, a visualization tool for helping record producers maximize the subjective separation between instruments, and to fill the perceived space with a full range of frequencies. This is available as a fun free download (http://omgaudio.com/incoherence/) for various platforms. Meredith Patterson of Integrated DNA Technology showed how to isolate DNA at home using shampoo, meat tenderizer, and a salad-spinner, and assured the audience that anthrax DNA could indeed theoretically be created using the web tools offered by her company. And after the very first Sunday presentation, one audience member claimed he found the new web programming language Wheat "so beautiful, it's made me cry!" The most stimulating concept of Day Two was arguably a programming triviality - in order to raise the level of debate in their online courseware, H2O, the Berkman Center of Harvard Law School introduced an artificial delay (call it "positive community latency" perhaps), so that posts were just as likely to be read if their authors took several days to craft them, as if they jumped in immediately with something inane. Slashdot is of course the canonical example of the inverse relation between speed and seriousness - if a latency of even an hour or two were introduced, and all posts made during that time displayed at once in order of karmic reputation, the general level of debate would surely rise substantially. See the CodeCon site for more details (http://www.codecon.org/2005/program.html) . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. Said to Pay Iraq Contractors in Cash
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://news.yahoo.com/news?tmpl=story&cid=542&u=/ap/iraq_loose_cash&printer…> Yahoo! U.S. Said to Pay Iraq Contractors in Cash 1 hour, 4 minutes ago By LARRY MARGASAK, Associated Press Writer WASHINGTON - U.S. officials in postwar Iraq (news - web sites) paid a contractor by stuffing $2 million worth of crisp bills into his gunnysack and routinely made cash payments around Baghdad from a pickup truck, a former official with the U.S. occupation government says. Because the country lacked a functioning banking system, contractors and Iraqi ministry officials were paid with bills taken from a basement vault in one of Saddam Hussein (news - web sites)'s palaces that served as headquarters for the Coalition Provisional Authority, former CPA official Frank Willis said. Officials from the CPA, which ruled Iraq from June 2003 to June 2004, would count the money when it left the vault, but nobody kept track of the cash after that, Willis said. "In sum: inexperienced officials, fear of decision-making, lack of communications, minimal security, no banks, and lots of money to spread around. This chaos I have referred to as a 'Wild West,'" Willis said in testimony he prepared to give Monday before a panel of Democratic senators who want to spotlight the waste of U.S. funds in Iraq. A senior official in the 1980s at the State and Transportation departments under then-President Ronald Reagan (news - web sites), Willis provided The Associated Press with a copy of his testimony and answered questions in an interview. James Mitchell, spokesman for the special inspector general for Iraq reconstruction, told the AP that cash payments in Iraq were a problem when the occupation authority ran the country and they continue during the massive U.S.-funded reconstruction. "There are no capabilities to electronically transfer funds," Mitchell said. "This complicates the financial management of reconstruction projects and complicates our ability to follow the money." The Pentagon (news - web sites), which had oversight of the CPA, did not immediately comment in response to requests Friday and over the weekend. But the administrator of the former U.S. occupation agency, L. Paul Bremer III, in response to a recent federal audit criticizing the CPA, strongly defended the agency's financial practices. Bremer said auditors mistakenly assumed that "Western-style budgeting and accounting procedures could be immediately and fully implemented in the midst of a war." When the authority took over the country in 2003, Bremer said, there was no functioning Iraqi government and services were primitive or nonexistent. He said the U.S. strategy was "to transfer to the Iraqis as much responsibility as possible as quickly as possible, including responsibility for the Iraqi budget." Iraq's economy was "dead in the water" and the priority "was to get the economy going," Bremer said. Also in response to that audit, Pentagon spokesman Bryan Whitman had said, "We simply disagree with the audit's conclusion that the CPA provided less than adequate controls." Willis served as a senior adviser on aviation and communications matters for the CPA during the last half of 2003 and said he was responsible for the operation of Baghdad's airport. Describing the transfer of $2 million to one contractor's gunnysack, Willis said: "It was time for payment. We told them to come in and bring a bag." He said the money went to Custer Battles of Middletown, R.I., for providing airport security in Baghdad for civilian passengers. Willis said a coalition driver would go around the Iraqi capital and disburse money from the a pickup truck formerly belonging to the grounded Iraqi Airways airline. The reason is because officials "wanted to meld into the environment," he said. Willis' allegations follow by two weeks an inspector general's report that concluded the occupying authority transferred nearly $9 billion to Iraqi government ministries without any financial controls. The money was designated for financing humanitarian needs, economic reconstruction, repair of facilities, disarmament and civil administration, but the authority had no way to verify that it went for those purposes, the audit said. Sen. Byron Dorgan (news, bio, voting record), head of the Democratic group that is holding Monday's hearing, said he arranged for Willis' testimony because majority Republicans have declined to investigate the suspected misuse of funds in Iraq. "This isn't penny ante. Millions, perhaps billions of dollars have been wasted and pilfered," Dorgan, D-N.D., said in an interview ahead of the Senate Democratic Policy Committee's session. Willis concluded that "decisions were made that shouldn't have been, contracts were made that were mistakes, and were poorly, if at all, supervised, money was spent that could have been saved, if we simply had the right numbers of people. ... I believe the 500 or so at CPA headquarters should have been 5,000." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

TSA's Secure Flight (was Re: CRYPTO-GRAM, February 15, 2005)
by R.A. Hettinga 15 Feb '05

15 Feb '05

At 6:23 AM -0600 2/15/05, Bruce Schneier wrote: > TSA's Secure Flight > > > >As I wrote last month, I am participating in a working group to study >the security and privacy of Secure Flight, the U.S. government's >program to match airline passengers with a terrorist watch list. In the >end, I signed the NDA allowing me access to SSI (Sensitive Security >Information) documents, but managed to avoid filling out the paperwork >for a SECRET security clearance. > >Last month the group had its second meeting. > >At this point, I have four general conclusions. One, assuming that we >need to implement a program of matching airline passengers with names >on terrorism watch lists, Secure Flight is a major improvement -- in >almost every way -- over what is currently in place. (And by this I >mean the matching program, not any potential uses of commercial or >other third-party data.) > >Two, the security system surrounding Secure Flight is riddled with >security holes. There are security problems with false IDs, ID >verification, the ability to fly on someone else's ticket, airline >procedures, etc. There are so many ways for a terrorist to get around >the system that it doesn't provide much security. > >Three, the urge to use this system for other things will be >irresistible. It's just too easy to say: "As long as you've got this >system that watches out for terrorists, how about also looking for this >list of drug dealers...and by the way, we've got the Super Bowl to >worry about too." Once Secure Flight gets built, all it'll take is a >new law and we'll have a nationwide security checkpoint system. > >And four, a program of matching airline passengers with names on >terrorism watch lists is not making us appreciably safer, and is a >lousy way to spend our security dollars. > >Unfortunately, Congress has mandated that Secure Flight be implemented, >so it is unlikely that the program will be killed. And analyzing the >effectiveness of the program in general, potential mission creep, and >whether the general idea is a worthwhile one, is beyond the scope of >the working group. In other words, my first conclusion is basically all >that they're interested in hearing. > >But that means I can write about everything else. > >To speak to my fourth conclusion: Imagine for a minute that Secure >Flight is perfect. That is, we can ensure that no one can fly under a >false identity, that the watch lists have perfect identity information, >and that Secure Flight can perfectly determine if a passenger is on the >watch list: no false positives and no false negatives. Even if we could >do all that, Secure Flight wouldn't be worth it. > >Secure Flight is a passive system. It waits for the bad guys to buy an >airplane ticket and try to board. If the bad guys don't fly, it's a >waste of money. If the bad guys try to blow up shopping malls instead >of airplanes, it's a waste of money. > >If I had some millions of dollars to spend on terrorism security, and I >had a watch list of potential terrorists, I would spend that money >investigating those people. I would try to determine whether or not >they were a terrorism threat before they got to the airport, or even if >they had no intention of visiting an airport. I would try to prevent >their plot regardless of whether it involved airplanes. I would clear >the innocent people, and I would go after the guilty. I wouldn't build >a complex computerized infrastructure and wait until one of them >happened to wander into an airport. It just doesn't make security sense. > >That's my usual metric when I think about a terrorism security measure: >Would it be more effective than taking that money and funding >intelligence, investigation, or emergency response -- things that >protect us regardless of what the terrorists are planning next. Money >spent on security measures that only work against a particular >terrorist tactic, forgetting that terrorists are adaptable, is largely >wasted. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Alleged mobsters guilty in vast Net, phone fraud
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.msnbc.msn.com/id/6928696/print/1/displaymode/1098/> MSNBC.com Alleged mobsters guilty in vast Net, phone fraud Mafia scheme said to have netted $659 million over 7 years By Mike Brunker Reporter MSNBC Updated: 8:22 p.m. ET Feb. 14, 2005 Writing a sudden ending to what authorities say is one of the biggest consumer fraud cases ever prosecuted, alleged members of one of New York's most notorious Mafia families pleaded guilty Monday to conspiracy and fraud charges stemming from an Internet and phone billing caper that bilked consumers out of more than $650 million. Prosecutors say the principals of the scheme, which ran from 1996 to 2003, are members of the Gambino crime family, an outfit better known for such muscle-and-blood criminal enterprises as gambling, loan sharking, protection rackets and creative bookkeeping for construction projects and garbage collection. But in this case, prosecutors said, the hoods targeted phone customers and Internet users, tricking them into responding to too-good-to-be-true offers of free porn, psychic readings, dating services and sports picks, and then putting the hurt on their pocketbooks with a series of unauthorized credit card and telephone charges. The mobsters also ripped off two federally supervised funds that subsidize rural phone companies through another billing scam. Alleged mastermind, Gambino 'capo' enter pleas Among those who entered guilty pleas Monday in U.S. District Court in Brooklyn - on the day jury selection was to have begun - were the alleged mastermind of the scheme, Richard Martino, 45, known in the New York tabloids as the "X-rated mobster," and 45-year-old Salvatore Locascio, described by authorities as a Gambino "capo," or captain. Under the plea bargain, Martino pleaded guilty to one count of conspiracy to commit mail and wire fraud and one count of extortion for forcefully trying to extract a $1 million payment from a porn industry rival. Martino faces up to 10 years in prison and agreed to forfeit $15 million under the deal. Locascio entered a guilty plea to a single count of money laundering and also faces up to 10 years in prison and forfeiture of $4.7 million. Three other alleged mob associates - Dennis Martino, brother of Richard Martino, Thomas Pugliese and Andrew Campos - pleaded guilty to a count of conspiracy to commit mail and wire fraud. A fourth man, Zev Mustafa, pleaded guilty to money laundering in connection with the scheme. Daniel Martino, Pugliese and Campos each face up to five years in prison and agreed to forfeit a total of $2.1 million, while Mustafa faces up to 10 years in prison and will forfeit $1.7 million. Prosecutors allege that Richard Martino, a Gambino "soldier," directed the scheme and paid $8 million of the proceeds directly to Locascio, the leader of his "crew," and funneled at least $40 million more into Gambino family coffers. Bank, phone company purchased The elaborate scheme brought in so much money that the defendants and various co-conspirators were able to purchase a telephone company and bank in Missouri, according to court documents. They also created at least 64 shell companies and opened a host of foreign bank accounts through which to pass their ill-gotten gains, the documents said. In an indictment returned in March 2003, prosecutors alleged a two-headed scheme: People who called 1-800 phone numbers advertising free samples of phone sex, psychic hot lines and dating services unwittingly triggered recurring monthly charges that appeared on their phone bills as "voice-mail services" and other innocuous services. At the same time, the scheme trapped Web surfers seeking adult content on the Internet by enticing them to enter their credit card information for "free" tours, only to begin billing them between $20 and $90 a month. The defendants routinely changed corporate billing names and merchant banks to stay one step ahead of authorities and foil Visa USA's fraud-detection system, according to court documents. In 1999, they began processing credit transactions in Guatemala to further muddy the waters, the documents said. Prosecutors charged that the Web sites used in the Internet scam were part of a joint venture formed in 1996 between Crescent Publishing Group Inc., a Manhattan company that published such high-profile adult magazines as Playgirl and High Society, and Lexitrans Inc. of Overland Park, Kan., a Web hosting company that they said was secretly controlled by Richard Martino. Surprise guilty pleas The surprise guilty pleas on Monday, following negotiations that lasted through the weekend, pre-empted what would have been one of the most closely watched mob trials in years. Using the power of plea bargains, prosecutors already had peeled off a number of alleged co-conspirators who were expected to testify against Martino and Locascio, including: Norman Chanes, a 58-year-old millionaire advertising executive and movie producer (co-producer of the 2000 film "Blue Moon," starring Ben Gazzara, Rita Moreno and "Sopranos" cast member Vincent Pastore), who allegedly advertised the 1-800 phone numbers used in the telephone fraud in magazines and newspapers around the country. Bruce Chew, 57, who was CEO of Crescent Publishing Co. Chew was a defendant in a Federal Trade Commission lawsuit against Crescent Publishing that led to a $30 million settlement in November 2001. Kenneth Matzdorff, a 48-year-old Missouri businessman who allegedly acted as a front man to purchase the Cass County Telephone Co. in Peculiar, Mo., and the Garden City Bank in Garden City, Mo., on behalf of Richard Martino and others. Matzdorff pleaded guilty in January to conspiracy to commit mail and wire fraud charges under a plea agreement. Another figure in the case who might have been called to testify is Carl Ruderman, a 60-something-year-old publisher and philanthropist who reportedly was the secret owner of Crescent Publishing. 'The invisible man' of porn Ruderman, dubbed "the invisible man" of porn by fellow skin magazine publisher Al Goldstein in 1989 for his low profile, was never charged with any crime, reportedly because he told authorities that he delegated responsibility for day-to-day operations of Crescent Publishing to Chew and had no knowledge of the billing scam. One former Crescent employee said that Ruderman certainly lived up to the "invisible man" sobriquet at the company's Manhattan offices. "We used to call him the Wizard of Oz, because you never saw the guy," said the employee, who spoke with MSNBC.com on condition of anonymity. "I saw him twice the whole time I worked for him." Former Gambino crime boss John Gotti Sr., forever known as the "Dapper Don," also had been expected to testify from the grave. Longtime New York newspaper crime reporter Jerry Capeci, who now publishes his work on the Ganglandnews.com Web site, said prosecutors had planned to play a tape of a wiretapped conversation from January 1990 in which Gotti sings the praises of newly minted mobsters Martino and Locascio, who had just been inducted into the Gambino family. 'I like the Richies' "I want guys that done more than killing," Capeci quotes Gotti as saying on the tape, obtained from a listening device planted in an apartment above the Ravenite Social Club in Manhattan's Little Italy. "I like the Richies. They're young - twenty-something, thirty-something -- They're beautiful guys. Ten years from now, these young guys we straightened out, they're going to be really proud of them." Gotti died in prison at the age of 61 on June 10, 2002, from complications of head and neck cancer while serving a sentence of life without parole for murder and racketeering. The criminal case was filed more than three years after the FTC announced that it had filed suit, along with the New York attorney general's office, to stop Crescent Publishing from "illegally billing thousands of consumers for services that were advertised as 'free,' and for billing other consumers who never visited the Web sites at all." The suit did not address the phone billing portion of the scam. In announcing the suit in August 2000, the FTC estimated that the "free tour Web sites" had generated income of $188 million between 1997 and October 1999, including $141 million in the first 10 months of 1999 alone. According to Luke Ford, a pioneer blogger and keen observer of the Internet porn scene, the scheme was able to roll up such huge numbers because of deals Crescent made with two Internet traffic brokers - Serge Birbrair and Yishai Habari - that resulted in millions of porn-seeking surfers a day being directed to the sites. Traffic brokers allegedly 'made millions' "Yishai and Serge made millions off the scam and escaped FTC prosecution because they only functioned as traffic brokers," Ford wrote on his Web site. Neither Birbrair nor Habari responded to e-mail requests for comment. In November 2001, the FTC announced that Crescent Publishing and the company's principal officers, Chew and David Bernstein, had agreed to pay $30 million to settle the suit. The settlement also barred the company from "charging, debiting or billing consumers" for any Web site services without first obtaining a $10 million bond that could be used "to satisfy any judgment entered against the defendants" following trial. Doug Wolfe, an FTC attorney who worked on the case, said that despite the settlement, many victims never received compensation. "Our biggest problem was we had to rely on the company's data to link individuals to cards," he said. As of late 2004, the redress center established to administer claims had issued refund checks to 189,646 accounts but had been unable to match names and credit card information for 887,793 others, he said. Wolfe said the agency never uncovered any link between Crescent and organized crime, but there were signs that this wasn't your run-of-the-mill Internet fraud case. "It certainly was unique in my experience in terms of the number of entities through which the money appeared to be moving," Wolfe told MSNBC.com. "At the same time there were some unusual legal maneuvers. Individuals on the eve of testifying would suddenly fire their lawyers and there was a general reluctance on the other side to engage in civil discovery." Phone bill 'cramming' comes under scrutiny While the Internet operation was taking a hit, the scheme in which consumers' phone bills were being improperly charged - a practice known as "cramming" - also was coming under scrutiny. Martino et al bought the Cass County Telephone Co.,or CassTel, a county telephone company in Peculiar, Mo., (pop. 2,600) with 8,000 customers, using Matzdorff as a front man and hiring him to run the company, according to the indictment. Martino also gave Matzdorff $3 million in February 2001 to buy the Garden City Bank in Garden City, Mo., for purposes of credit card processing, it said. At the same time, prosecutors say Martino also formed a billing company called USP&C to place the bogus charges on customers' phone bills and charge the credit cards of surfers who visited Crescent Publishing's porn sites. Matzdorff told prosecutors in New York that USP&C set up a call center to handle complaints from outraged customers that handled an average of 17,000 calls a week at the height of the scheme. Though USP&C billed telephone customers on behalf of numerous companies and gave varying descriptions of the services allegedly provided, the billing agent's high charge-back rate began to attract attention from phone regulators. Complaints prompted wave of refunds In 1999, the California Public Utilities Commission investigated USP&C's business conduct and found that of $51.5 million in billings to California customers over the previous 18 months, 52 percent were refunded after customers complained. The PUC eventually fined USP&C $1.75 million for improper billing, but it was never able to collect it. Estimates of the amount netted by the scam have grown steadily since the March 2003 indictment was unsealed, when prosecutors estimated that the Internet end of the operation netted $230 million while the phone scam brought in approximately $200 million in revenue. Later, federal charges filed in Kansas added $9 million to that tally, money that prosecutors said the mob-run companies stole by overbilling two federally supervised telecommunications funds - the Universal Service Administrative Co. and the National Exchange Carriers Association. But sources familiar with the case told MSNBC.com that the estimate swelled recently when prosecutors obtained more information indicating that the phone "cramming" actually generated at least $420 million, bringing the overall total to $659 million. Given the riches the Gambino family allegedly struck in what experts say apparently was its first major foray into Internet crime, it is surprising that authorities say the Crescent Publishing case is still the exception to the Cosa Nostra rule. Dave Thomas, chief of the FBI's Computer Intrusion Section, said in an interview published Nov. 29, 2004, by the trade publication Network World Fusion that there is no evidence indicating that the Mafia has moved into Internet crime in a big way. No 'big move' to Internet "We haven't seen a big move with the traditional Italian-based Mafia groups to the Internet ... not like we have with the Eastern European hacking groups," he said. "But as the money (to be made) becomes more and more widely publicized, they probably will." Capeci, the crime reporter who specializes in the mob, said there should be no doubt about that. "There's no question Locascio's crew is a bit more advanced or sophisticated than many other mob families, but the trend among the gangsters is to move away from the stuff that the law enforcement community is well aware of and to move into new things," he said. "And there's nothing they won't do if they can figure out how to do it." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FEC May Tighten Restrictions On Internet Political Activity
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.drudgereport.com/flash3fec.htm> The Drudge Report FEC May Tighten Restrictions On Internet Political Activity Mon Feb 14 2005 10:38:41 ET The Federal Election Commission next month will begin looking at tightening restrictions on political activities on the Internet, ROLL CALL reports Monday. The FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of 'public communications. Specifically, the FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of "public communications." While coordinated communications are considered campaign contributions and therefore subject to strict contribution limits, current FEC regulations adopted in 2002 carve out an exemption for coordinated political communications that are transmitted over the Internet. Developing... -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

J.P. Morgan Paying $2.1M in Settlement
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.forbes.com/home/feeds/ap/2005/02/14/ap1826161.html> Forbes Associated Press Update 1: J.P. Morgan Paying $2.1M in Settlement 02.14.2005, 06:02 PM The securities arm of J.P. Morgan Chase & Co. has agreed to pay $2.1 million to settle regulators' charges that it failed to preserve e-mails sought by the authorities in their 2002-2003 investigation of alleged conflicts of interest at Wall Street investment houses. J.P. Morgan Securities Inc. is paying $700,000 in civil fines in each of three separate settlements with the Securities and Exchange Commission, the New York Stock Exchange and the National Association of Securities Dealers, which is the brokerage industry's self-policing organization. The investment firm neither admitted nor denied the allegations of violating record-keeping rules. J.P. Morgan spokesmen declined comment. J.P. Morgan was among ten of Wall Street's biggest firms that paid a total $1.4 billion and adopted reforms as a result of the investigation, in which regulators found that they issued biased ratings on stocks to lure investment-banking business. J.P. Morgan's share of the industrywide settlement, reached in April 2003, was $80 million. In the course of the investigation, begun in April 2002, J.P. Morgan told the regulators that all the relevant e-mails had been provided, the SEC said. In fact, the agency, said, the firm's systems and procedures for retaining e-mails "were inadequate to ensure that all electronic communications relating to (its) business were preserved for three years and for the first two years in an easily accessible place" as required by the rules. Companies' retention of internal documents took on new importance after the Enron scandal, in which key papers were shredded, and the landmark anti-fraud law enacted in July 2002 created new penalties for document destruction. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Don't Trust Your Eyes or URLs (was Re: TidBITS#766/14-Feb-05)
by R.A. Hettinga 15 Feb '05

15 Feb '05

At 6:21 PM -0800 2/14/05, TidBITS Editors wrote: >Don't Trust Your Eyes or URLs >----------------------------- > by Glenn Fleishman <glenn(a)tidbits.com> > > The clever folks at the Shmoo Group, a bunch of interesting > security folks who punch holes in assumptions about what's > secure on the Internet, have discovered a simple way to fool > most browsers into believing that they've connected to a secure > Web site when they've been spoofed into connecting to a rogue > location with a different name. It's ironic, but Internet Explorer > is entirely exempt from this spoof. Opera, Safari and KHTML-based > browsers, and all Mozilla and Firefox browsers suffer from this > weakness on all platforms. > ><http://www.shmoo.com/> ><http://www.shmoo.com/idn/homograph.txt> > > In brief, the Shmoos found that a poorly implemented method > of allowing international language encoding within domain names, > called International Domain Name (IDN) support, allows a malicious > party to display what appears to be one domain name in the > Location field of a browser while connecting you to another. > Phishing scams have just become more difficult to identify. > > This exploit is made possible by a system called "punycode," > which has been widely adopted according to the Shmoo Group. > Domain names that use characters outside of unaccented Western > alphabet letters via Unicode/UTF-8 are converted into a string > of Roman letters (see Matt Neuburg's "Two Bytes of the Cherry: > Unicode and Mac OS X" for more information on Unicode). This > conversion isn't a problem, per se: it means that domain names > outside of the English character set can be used freely without > confusing browsers and can be registered using simple English > characters for backwards compatibility within the domain naming > infrastructure. > ><http://db.tidbits.com/getbits.acgi?tbser=1217> > > The flaw is twofold: first, affected browsers display whatever the > encoded version of the character is, which might look identical to > another language's character. For instance, the Shmoos use the > Russian lower-case letter A, which is encoded as "&1072;" in UTF-8 > using decimal (base 10) notation, and displays in browsers that > support IDN as a lower-case A indistinguishable from a Roman > lowercase A. > ><http://www.fileformat.info/info/unicode/char/0430/> > > The second problem leads from the first: it's possible > to have a legitimate SSL (Secure Sockets Layer) digital > certificate for the punycode-based domain name. Thus, in > an example that the Schmoos posted for a while (now replaced), > you see "https://www.paypal.com/" in your browser URL field, > and the SSL signals are all there - you get no warnings, the > lock icon is present, and Firefox's Security tab in the Page > Info window says the Web site's identity is verified. > > Click View in that same tab in Firefox, and you'll see > the full punycode name of the Web site, however, which is > "www.xn--pypal-4ve.com". Copy the URL from the Location > field and paste it into Terminal, and you'll see the encoded > version in standard UTF-8 format, too, which looks like > "www.p&1072;ypal.com". > > I don't know that there's an easy solution to this problem. > It's the result of choice by the developers of the various > browsers to display precisely what a Unicode character looks > like, which is reasonable enough. But at the same time they > use a kludgy, opaque hack in the background to map that Unicode > character to an English character to provide full backwards > compatibility with what was once a U.S.-centric domain naming > system, one that retains substantial vestiges of that history. > > If you're a Firefox user, I recommend obtaining and installing > a utility called SpoofStick, which alerts you to what is being > called "homograph" spoofing; that is, the character or glyph looks > like another, unrelated glyph. If you visit the Shmoo site with > SpoofStick installed, you get a big lovely warning. > ><http://www.corestreet.com/spoofstick/> > > Trust has gone out the window when you follow links in email or > on Web sites. There's no longer a way to be sure that the domain > name you're visiting is the one you think you are unless you check > the URL out in Terminal or have SpoofStick installed. > > Realistically, the upshot of this situation is that you must be > even more careful about following links you receive in email to > sites that ask for sensitive information. A message that purports > to be from PayPal customer service, for instance, may look right > and even use URLs that appear to connect to PayPal's site, but > could in fact be taking you to another site designed to capture > your username and password. The likelihood of falling victim to > a spoofed URL on the Web itself is less likely, assuming you start > from a site that's a relatively trusted source. When in doubt, > fall back on common sense and check the URL by pasting suspect > URLs into Terminal to see if they're concealing any unusual > Unicode characters. Hopefully we'll see browser fixes soon: > simply displaying the full punycode-based domain name alongside > its actual representation would at least highlight what's > happening behind the scenes without interfering with navigation > or Web pages. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Making your IM secure--and deniable
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://news.com.com/2102-7355_3-5576246.html?tag=st.util.print> CNET News Making your IM secure--and deniable By Robert Lemos Story last modified Mon Feb 14 17:05:00 PST 2005 SAN FRANCISCO--When you hit the Send button on an instant message, do you really know who is on the other end? Two researchers at the University of California at Berkeley have created an add-on to instant messaging that they claim will enable the participants to identify each other and have a secure conversation without leaving any proof that the chat occurred. The result, dubbed off-the-record (OTR) messaging by security researchers Ian Goldberg and Nikita Borisov, is a plug-in for the Gaim instant-messaging client that enables encrypted messages sans leaving a key--a sequence of characters--that could be used to verify that the conversation happened. That attribute, known in cryptography as perfect forward security, also prevents snoopers from reading any copies of the conversation. "If tomorrow, my computer is broken into and the encryption key is stolen, the attacker can't read future messages," said Goldberg, a graduate of Berkeley. In order for a secure and deniable IM conversation to occur, both parties need to have the off-the-record program installed on Gaim or use America Online's Instant Messenger with a server set up to be a proxy with software also developed by Goldberg and Borisov, the researchers said. When a previously unregistered user wants to have an OTC conversation, a dialog box will appear with a digital key, identifying the sender. If the user accepts the credentials of the person contacting him, the key will be stored on his computer so that in the future, the sender is considered to be trusted. After that, the two participants can chat securely; the conversation is encoded so that others cannot intercept and read it. Goldberg and Borisov presented their program at the annual CodeCon gathering of developers Saturday. People worried about instant-messaging security can download the software from the duo's site. Goldberg said current messaging is insecure and criticized other solutions for leaving around logs and encryption keys that could be used as proof that a conversation happened. He said OTR messaging would give the participants the security without leaving any more trace of the conversation than today's instant-messaging clients--a worry for the privacy-centric security community. "I would like to see this on by default," Goldberg said. "When you chat today, the messages are going through the clear, and there is no proof of who you are talking to." While both the OTR messaging plug-ins and today's instant-messaging clients enable either participant to record logs of a conversation, those logs mean little after the conversation, Goldberg argued. The logs could be edited to add content. That's why the two researchers avoided using digital signatures, Goldberg said. That technology for encrypting messages would have also acted as a digital signature and left a signed record of the conversation. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0