February 2005 - cypherpunks-legacy

Tester claims 90% of VPNs open to hackers
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.computerweekly.com/print/ArticlePrinterPage.asp?liArtID=136571&l…> Printed from ComputerWeekly.com IT Management: Security by Antony Savvas Tuesday 8 February 2005 Tester claims 90% of VPNs open to hackers Security testing company NTA Monitor has claimed that 90% of virtual private networks are open to hackers. Over a three-year period of testing VPNs at large companies, NTA Monitor said 90% of remote access VPN systems have exploitable vulnerabilities, even though many companies, including financial institutions, have in-house security teams. Flaws include "user name enumeration vulnerabilities" that allow user names to be guessed through a dictionary attack because they respond differently to valid and invalid user names. Roy Hills, NTA Monitor technical director, said, "One of the basic requirements of a user name/password authentication is that an incorrect log-in attempt should not leak information as to whether the user name or password is incorrect. However, many VPN implementations ignore this rule." The fact that VPN user names are often based on people's names or e-mail addresses makes it relatively easy for an attacker to use a dictionary attack to recover a number of valid user names in a short period of time, said Hills. Passwords can also be made harder to crack by deploying a mixture of characters and numbers. Hills said a six-character password can be cracked in about 16 minutes using standard "brute force" cracking software. However, a six-character password combining letters and numbers could take two days to crack. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Hold the Phone, VOIP Isn't Safe
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.wired.com/news/print/0,1294,66512,00.html> Wired News Hold the Phone, VOIP Isn't Safe By Elizabeth Biddlecombe? Story location: http://www.wired.com/news/technology/0,1282,66512,00.html 02:00 AM Feb. 07, 2005 PT In recognition of the fact that new technologies are just as valuable to wrongdoers as to those in the right, a new industry group has formed to look at the security threats inherent in voice over internet protocol. The VOIP Security Alliance, or VOIPSA, launches on Monday. So far, 22 entities, including security experts, researchers, operators and equipment vendors, have signed up. They range from equipment vendor Siemens and phone company Qwest to research organization The SANS Institute. They aim to counteract a range of potential security risks in the practice of sending voice as data packets, as well as educate users as they buy and use VOIP equipment. An e-mail mailing list and working groups will enable discussion and collaboration on VOIP testing tools. VOIP services have attracted few specific attacks so far, largely because the relatively small number of VOIP users doesn't make them a worthwhile target. (A report from Point Topic in December counted 5 million VOIP users worldwide.) But security researchers have found vulnerabilities in the various protocols used to enable VOIP. For instance, CERT has issued alerts regarding multiple weaknesses with SIP (session initiation protocol) and with H.323. Over the past year, experts have repeatedly warned that VOIP abuse is inevitable. The National Institute of Standards and Technology put out a report last month urging federal agencies and businesses to consider the complex security issues often overlooked when considering a move to VOIP. NIST is a member of VOIPSA. "It is really just a matter of time before it is as widespread as e-mail spam," said Michael Osterman, president of Osterman Research. Spammers have already embraced "spim" (spam over instant messaging), say the experts. Dr. Paul Judge, chief technology officer at messaging-protection company CipherTrust, says 10 percent of instant-messaging traffic is spam, with just 10 to 15 percent of its corporate clients using IM. "It is where e-mail was two and a half years ago," said Judge. To put that in perspective, according to another messaging-protection company, FrontBridge Technologies, 17 percent of e-mail was spam in January 2002. It put that figure at 93 percent in November 2004. So the inference is that "spit" (spam over internet telephony) is just around the corner. Certainly, the ability to send out telemarketing voicemail messages with the same ease as blanket e-mails makes for appealing economics. Aside from the annoyance this will cause, the strain on network resources when millions of 100-KB voicemail messages are transmitted, compared with 5- or 10-KB e-mails, will be considerable. But the threat shouldn't be couched solely within the context of unlawful marketing practices. Users might also see the audio equivalent of phishing, in which criminals leave voicemails pretending to be from a bank, said Osbourne Shaw, whose role as president of ICG, an electronic forensics company, has led him to try buying some of the goods advertised in spam. In fact, according to David Endler, chairman of the VOIP Security Alliance and director of digital vaccines at network-intrusion company TippingPoint, there are many ways to attack a VOIP system. First, VOIP inherits the same problems that affect IP networks themselves: Hackers can launch distributed denial of service attacks, which congest the network with illegitimate traffic. This prevents e-mails, file transfers, web-page requests and, increasingly, voice calls from getting through. Voice traffic has its own sensitivities, which mean the user experience can easily be degraded past the point of usability. Furthermore, additional nodes of the network can be attacked with VOIP: IP phones, broadband modems and network equipment, such as soft switches, signaling gateways and media gateways. Endler paints a picture in which an attack on a VOIP service could mean people would eavesdrop on conversations, interfere with audio streams, or disconnect, reroute or even answer other people's phone calls. This is a concern to the increasing number of call centers that put both their voice and data traffic on a single IP network. It is even more of a concern for 911 call centers. But Louis Mamakos, chief technology officer at broadband telephony provider Vonage, says he and his team "spend a lot of time worrying about security" but the problems the company has seen so far have centered on "more pedestrian" threats like identity theft. Vonage has not yet signed up for the VOIP Security Alliance, said Mamakos, and employees already spend a lot of time working on security issues with technology providers. "I'm not sure if (VOIPSA) is a solution to a problem we don't have yet," he said. "We need to judge what the incremental value is in working with another organization." He also talked about how hard it would be to break into Vonage's service. Access to Vonage's signaling traffic requires authentication. The infrastructure is much more distributed than the websites that have been taken offline by denial of service attacks. And anyone wanting to eavesdrop on a Vonage phone conversation would have to be physically very close to the broadband connection leading to the target, as the farther away the eavesdropper is, the more commingled the target's voice traffic will be with other traffic on the network. Meanwhile Kelly Larrabee, a spokeswoman for the peer-to-peer VOIP provider Skype, noted that Skype users control what information about themselves is available and who can contact them. She also said end-to-end encryption is used to protect voice conversations. The only vulnerability so far, aside from uncertified third-party applications, is through file transfers -- and again, this is under user control. But these words could be like a red rag to a bull. As one commentator put it, a continuous duel is going on between network users and abusers, and spammers and hackers could well be reading this article. This poses the question of whether a group like the VOIP Security Alliance should refrain from announcing its efforts in the media and from making its membership and e-mail list free and open to all. In response, said VOIPSA's Endler, "The people we really have to worry about are already thinking about (how to misuse VOIP)." Today's effort is to ensure that VOIP systems are reinforced "before it gets to the point that there are easily available tools for the script kiddies to use," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RSA Conference, and BA Cypherpunks
by Trei, Peter 09 Feb '05

09 Feb '05

Once again, the RSA Conference is upon us, and many of the corrospondents on these lists will be in San Francisco. I'd like to see if anyone is interested in getting together. We've done this before. At past conferences, we've had various levels of participation, from 50 down to 3. Since the BAC Physical Meetings seem to have pretty well died out, I'd like to propose that those of us who are interested get together for lunch or dinner at some point. I'll be arriving on site Monday afternoon, and leaving Friday morning. Thursday night, at least, is already spoken for. At the moment, it looks like Monday or Tuesday night may be the best, though a lunch is also possible. Any takers? Peter Trei ptrei(a)rsasecurity.com RSA Data Security Conference Dates: Feb 14-18 2005 Place: Moscone Center, San Francisco http://www.rsaconference.com While the full conference is rather expensive, note that you can get a free Expo pass if you register online by 5pm Feb 14th.

3 2

Standards for Efficient Cryptography Group (SECG) Announce New Initiatives
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.newswire.ca/en/releases/archive/February2005/09/c2130.html?view=…> Canada NewsWire Group CERTICOM CORP. Attention Business Editors: Standards for Efficient Cryptography Group (SECG) Announce New Initiatives Elliptic Curve Cryptography protocol test site and test certificate authority to promote interoperability and facilitate faster time to-market MISSISSAUGA, ON, Feb. 9 /CNW/ - Two new initiatives being spearheaded by the Standards for Efficient Cryptography Group (SECG) will help developers quickly and effectively test elliptic curve cryptography (ECC)-based implementations to facilitate faster time-to-market, according to Certicom, a founding member of SECG. Announced today, an ECC protocol test site and certificate authority (CA) will be available to SECG members in the spring of 2005. The SECG, an industry consortium, was founded in 1998 to develop commercial standards that facilitate the adoption of efficient cryptography and interoperability across a wide range of computing platforms. Where standards already exist, SECG may promote a refined, peer-reviewed profile of the broader standard to promote adoption and interoperability. The SECG also provides guidance to governments and organizations that are developing cryptographic standards. The initiatives announced today include: - ECC protocol test site: developers will be able to vet their protocol implementations against reference implementations to test interoperability. Each test - such as Transport Layer Security (TLS) and S/MIME protocols - has been peer-reviewed by the leading ECC and protocol authorities. - ECC-based certificate authority: the group will issue free ECC-based certificates for testing and prototyping. "SECG's role is to make it easier to use ECC by promoting practical standards, interoperability and by providing mechanisms to test implementations and prototypes," said William Lattin, chair of SECG. "Recent developments, such as advances in the cryptographic world and U.S. government security initiatives, have elevated the need for ECC and for resources like ours." "The work of SECG is valuable resource for companies committed to ECC," says Gloria Navarre, senior architect, Unisys Global Security Practice. "As Unisys develops next-generation ECC applications, such as our solutions to help banks embrace image exchange in check processing, and transform payments operations as a whole, we can take advantage of the expertise, interoperability and testing standards that SECG offers to provide new levels of security to our clients and their customers." "SECG enables access to proven and effective algorithms and protocols to secure a communication channel between computers. It is particularly important when communicating computers have limiting computational resources and when the bandwidth of the channel has limiting capacity. This is the case of important mailing applications where Pitney Bowes has established a strong leadership position worldwide. In addition SECG allows to have a common foundation for all communication security needs regardless of the limiting factors. This in turn enables interoperability between a broad variety of applications," said Dr. Leon Pintsov, Pitney Bowes Fellow and vice president, International Standards and Advanced Technology. ECC, a computationally efficient form of cryptography, is used in a growing number of sectors ranging from consumer electronics, embedded devices and semiconductors to government and financial services. Several changes have spurred the adoption of ECC. The first is the need for a stronger public-key cryptosystem that doesn't affect performance. For example, a high security encryption algorithm like the Advanced Encryption Standard (AES) demands equivalent security for the accompanying digital signatures and key exchanges. To achieve this level of security without overwhelming the processors of most mobile devices, developers would need ECC, which offers equivalent security to other competing technologies but with much smaller key sizes. The second is the National Security Agency's recent decision to name ECC the public-key cryptosystem needed to meet the new, stronger security requirements under its crypto modernization program. The SECG is open to all interested parties who are willing to contribute to the ECC standards development process. To become a member of the SECG, simply send an email to the SECG mailing list (secg-talk-request(a)lists.certicom.com) with the word "SUBSCRIBE" in the subject line. To find out more about SECG and to download the latest standards, visit www.secg.org, or visit us at the RSA conference, in the Certicom booth No. 430, February 14-18, Moscone Center, San Francisco. About SECG The Standards for Efficient Cryptography Group (SECG) is an industry consortium for the development of standards based upon Elliptic Curve Cryptography (ECC). It was chartered to develop commercial standards that specify the basis for creating interoperable, cost-effective security solutions across a wide range of computing platforms. The SECG was founded in 1998 by Certicom and currently includes member companies such as: Entrust, Fujitsu, Pitney Bowes, Unisys and Visa International. Visit www.secg.org. About Certicom Certicom Corp. (TSX: CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Visit www.certicom.com. About Pitney Bowes Pitney Bowes is the world's leading provider of integrated mail and document management systems, services and solutions. The $5 billion company helps organizations of all sizes efficiently and effectively manage their mission-critical mail and document flow in physical, digital and hybrid formats. Its solutions range from addressing software and metering systems to print stream management, electronic bill presentment and presort mail services. With approximately 33,000 employees worldwide, Pitney Bowes serves more than 2 million businesses through direct and dealer operations. For more information about Pitney Bowes please visit http://www.pb.com. About Unisys Unisys is a worldwide information technology services and solutions company. Our people combine expertise in consulting, systems integration, outsourcing, infrastructure and server technology with precision thinking and relentless execution to help clients, in more than 100 countries, quickly and efficiently achieve competitive advantage. For more information, visit www.unisys.com. Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder NSE and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. %SEDAR: 00003865E For further information: please contact: Tim Cox, Zing Public Relations, (650) 369-7784, tim(a)zingpr.com; Brendan Ziolo, Certicom Corp., (613) 254-9267, bziolo(a)certicom.com CERTICOM CORP. CERTICOM CORP. - More on this organization Quotes & Charts News Releases (79) Webcast Company Earnings CIC.(TSX) STANDARDS FOR EFFICIENT CRYPTOGRAPHY GROUP STANDARDS FOR EFFICIENT CRYPTOGRAPHY GROUP - More on this organization News Releases (1) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Group Aims to Make Internet Phone Service Secure
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://online.wsj.com/article_print/0,,SB110790485798349353,00.html> The Wall Street Journal February 9, 2005 TELECOMMUNICATIONS Group Aims to Make Internet Phone Service Secure Alliance of Tech Companies Looks for Ways To Head Off Attacks by Hackers, Viruses By RIVA RICHMOND DOW JONES NEWSWIRES February 9, 2005; Page D4 A group of more than 20 technology companies and computer-security organizations has gone on the offensive to protect the burgeoning Internet telephone service from hackers, viruses and other security problems. The VOIP Security Alliance, which was announced earlier this week, will focus on uncovering security problems and promoting ways to reduce the risk of attack for voice over Internet protocol, or VOIP, technology. The group, known as VOIPSA, includes companies such as 3Com Corp., Alcatel SA, Avaya Inc., Siemens AG, Symantec Corp. and Ernst & Young LLP. Other members include the National Institute of Standards and Technology, a federal government agency; the SANS Institute, a research organization for network administrators and computer-security professionals; and several universities. The group's goal is to help make VOIP as secure and reliable as traditional telephone service. VOIP breaks voice into digital information and moves it over the Internet. That can make phone service much cheaper, but it also opens the door to the kind of security woes that have come to plague the Internet. VOIP enthusiasts worry that security and privacy problems could hamper adoption of the technology. "VOIP has a lot of great value propositions, but in order for it to be successful, it has to be secured" and offer service quality that's on par with the current phone system, said David Endler, chairman of the alliance and an executive at TippingPoint, a security company that recently was acquired by 3Com. "VOIPSA is a first step in doing that." Internet telephone service is expected to be rolled out rapidly to consumers and business customers, starting this year. Mr. Endler said many network operators don't realize they need to alter their security strategies when they add Internet phone service. For instance, traditional firewalls cannot police VOIP traffic, he said, and so networks will need to be upgraded with newer security technologies. There's little understanding of what security problems VOIP might introduce and what kind of defensive measures need to be taken. VOIPSA intends to improve that situation by sponsoring research, uncovering vulnerabilities, disseminating information about threats and security measures, and providing open-source tools to test network-security levels. Because VOIP will be dependent on the Internet, there's little hope that security troubles can be avoided, said Alan Paller, director of research at the SANS Institute, though early action by technology makers to address problems is positive and welcome. "It's not a lightweight problem," he said. "How well would you do with no phone?" If Internet attacks can disrupt phone service, "you radically expand the number of victims," he said. "VOIP networks really inherit the same cyber-security threats that data networks are today prone to, but those threats take greater severity in some cases," Mr. Endler said. For instance, a life-or-death emergency call to 911 might not get through if a network is crippled by a hacker attack. Worse, a broad assault on the phone system could become a national security crisis that causes economic damage. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

LA Times on brinworld, complete with nothing to hide quote
by Major Variola (ret) 08 Feb '05

08 Feb '05

Article Published: Sunday, February 06, 2005 - 7:14:24 PM PST Who's got an eye on you? Secret cameras are everywhere By Andrea Cavanaugh, Staff Writer Smile! If you're making your way around Los Angeles -- or any metropolitan area in America these days -- there's a good chance your movements are being recorded by a surveillance camera. Once limited mostly to banks and convenience stores, the beady eye of the surveillance camera has appeared nearly everywhere over the past decade. Cheaper surveillance systems and heightened fears of terrorist attacks have created a world that is increasingly captured on camera. "If you're outside doing anything, you're being recorded 50 percent of the time," said Paul Ramos, vice president of sales and marketing for Fairfax Electronics, a Los Angeles company that sells security systems. "If you're shopping or attending an event, it goes up to 90 percent. Yes, Big Brother is there, and Big Brother is strong." Perched on rooftops and under eaves, cameras discreetly rake shopping centers, stadiums, office buildings and parking lots. Police say surveillance cameras, whether installed by businesses, homeowners or local governments, act as a powerful law-enforcement tool and crime deterrent. Law-abiding people have nothing to worry about, said Lt. Paul Vernon of the Los Angeles Police Department. "When people start talking about Big Brother, I say, 'I've got nothing to hide.' Those cameras aren't looking into my home, and if they were, it would be pretty boring." Although law-enforcement agencies hail the technology as a labor-saving device that allows them to patrol much larger areas with fewer sets of eyes, many civil libertarians view surveillance cameras as a creeping erosion of privacy rights. "How would you like to be followed around by a slimy guy in a raincoat who records everything you do? It's a technological version of a slimy guy in a raincoat," said privacy expert Lauren Weinstein, who is producing a radio series about technology's impact on society. "The difference is, you can't see it, you don't know what it's pointed at, or how long the images are going to be stored." The mostly unregulated recording takes place with a tacit nod from the U.S. Supreme Court, which has indicated again and again that people have no reasonable expectation of privacy in public places. Government agencies across the United States are installing cameras in as many public areas as possible, but they are still behind the curve compared with European cities, Ramos said. In Los Angeles, surveillance devices increasingly are used by government to patrol public places. Several recently installed cameras along Hollywood Boulevard scan stretches popular with tourists and criminals alike. And, buoyed by the success of a surveillance program at crime-plagued MacArthur Park west of downtown, the LAPD recently unveiled a camera system capable of scanning thousands of license plates per hour and employing controversial facial-recognition software to pinpoint known criminals. Once clunky and obtrusive, some surveillance devices are now so small they're nearly undetectable. And the days of scratchy, black-and-white images recorded on videotape are long gone. Advances in technology mean crystal-clear digital pictures that can be reviewed in real time -- as they occur. "These are beautiful tools," said Ramos, whose company sells 20 to 30 surveillance systems each month. "It's the ability to be anywhere in the world and see what's going on, and also review what happened yesterday, or last week, or last month." Although the cameras raise the hackles of privacy advocates, most people don't mind being recorded everywhere they go, said A. Michael Noll, a communications professor at the University of Southern California. Graduate students polled about privacy issues routinely rank surveillance cameras nearly at the bottom of a long list of concerns, he said. "Most people just don't care about being on camera," Noll said. "In Los Angeles, they probably enjoy it. They probably see it as a screen test." Northridge resident Rochelle Matthews sees it as an invasion of privacy. The 37-year-old insurance agent said she doesn't like being under constant scrutiny. "What are they looking for? I don't think everything needs to be patrolled. People need and deserve privacy." Chatsworth resident Leanne Vince said she doesn't mind being recorded when she ventures out in public. Only criminals need to worry about being under surveillance, the 35-year-old music company executive said. "It doesn't bother me at all because I'm not doing anything wrong," she said. "If I'm at the grocery store and they're following me, so what? It's technology. You take the good with the bad." But Weinstein cautioned that constant surveillance can cause the shadow of suspicion to fall on the innocent when innocuous activities are misinterpreted. "A lot of people don't care, but they haven't thought about it," he said. "The dark side of this stuff isn't discussed." The benefits of surveillance cameras, such as capturing Oklahoma City bomber Timothy McVeigh on film just before he picked up the rental truck used in the bombing, far outweigh the privacy concerns, Noll said. And the concerns of those "screaming about Big Brother" may be overblown, Noll said. "If someone were tracking me down the street, I might care," he said. "But there aren't enough people at the other end to be watching all this surveillance." Armed with that knowledge, experts are now developing software that alerts authorities when certain types of behavior are detected. Weinstein cautioned that the practice of recording people in nearly every public place could escalate out of control. "It's always a balancing act," he said. "It's not to say you have a total expectation of privacy in public places, but there shouldn't be none. "Unless we want to live in a pervasive surveillance society where all of your moves are tracked and recorded, we'd better start putting rules in place."

1 0

[i2p] weekly status notes [feb 8] (fwd from jrandom@i2p.net)
by Eugen Leitl 08 Feb '05

08 Feb '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Identity thieves can lurk at Wi-Fi spots
by R.A. Hettinga 08 Feb '05

08 Feb '05

<http://www.usatoday.com/tech/news/2005-02-06-evil-twin-usat_x.htm> USA Today Identity thieves can lurk at Wi-Fi spots By Jon Swartz, USA TODAY SAN FRANCISCO - Coffee shop Web surfers beware: An evil twin may be lurking near your favorite wireless hotspot. Thieves are using wireless devices to impersonate legitimate Internet access points to steal credit card numbers and other personal information, security experts warn. So-called evil-twin attacks don't require technical expertise. Anyone armed with a wireless laptop and software widely available on the Internet can broadcast a radio signal that overpowers the hot spot. How to avoid an 'evil twin'?? Install personal firewall and security patches. Use hot spots for Web surfing only. Enter passwords only into Web sites that include an SSL key at bottom right. Turn off or remove wireless card if you are not using a hot spot. Avoid hot spots where it's difficult to tell who's connected, such as at hotels and airport clubs. If hot spot is not working properly, assume password is compromised. Change password and report incident to hot spot provider. Do not use insecure applications such as e-mail instant messaging while at hot spots. Source: AirDefense Then, masquerading as the real thing, they view the activities of wireless users within several hundred feet of the hot spot. "It could be someone sitting next to you on a plane or in a parking lot across the street from a coffee shop," says Jon Green, director of technical marketing at Aruba Wireless Networks, which makes radio-wave-scanning equipment that detects and shuts down bogus hot spots. "Wireless networks are wide open," says Steve Lewack, director of technology services for Columbus Regional Medical Center in Columbus, Ga. The facility uses software and sensors to monitor 480 wireless devices used by medical personnel at 110 access points. Last month, it stopped about 120 attempts to steal financial information from medical personnel and patients - double the number of incidents from a few months earlier. The recent surge in evil-twin attacks parallels phishing scams - fraudulent e-mail messages designed to trick consumers into divulging personal information. Though the problem is in its infancy, it has caught the attention of some businesses heavily dependent on wireless communications. But most consumers aren't aware of the threat, security expert Green says. Wi-Fi, or wireless Internet, sends Web pages via radio waves. Hot spots are an area within range of a Wi-Fi antenna. As the technology has grown - there are now about 20,000 hot spots in the USA, up from 12,000 a year ago - so too have security concerns. Anil Khatod, CEO of AirDefense, a maker of software and sensors, estimates break-ins number in the hundreds each month in the USA. Companies employing hundreds of people with wireless laptops are especially vulnerable to evil-twin scams. When a worker's information is filched, it can expose a corporate network. "It presents a serious, hidden danger to Web users," says Phil Nobles, a wireless-security expert at Cranfield University in England who has researched the threat. "It's hard to nab the perpetrator, and the victim has no idea what happened." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

How Privacy Went Public
by R.A. Hettinga 08 Feb '05

08 Feb '05

<http://www.opinionjournal.com/extra/?id=110006265> OpinionJournal WSJ Online Wall Street Journal AT LAW How Privacy Went Public Penumbras and emanations make strange bedfellows. BY JAMES TARANTO Tuesday, February 8, 2005 12:01 a.m. EST Last week a state judge held that New York City's refusal to issue marriage licenses to same-sex couples violates the constitutional right to privacy. When the Massachusetts Supreme Judicial Court mandated the recognition of same-sex marriage in 2003, it too cited the right to privacy. Whatever the merits of gay marriage, this is a case of judicial activism run amok, for the contemporary right to privacy has its roots precisely in the traditional definition of marriage. "Would we allow the police to search the sacred precincts of marital bedrooms for telltale signs of the use of contraceptives?" Justice William O. Douglas asked rhetorically in the 1965 U.S. Supreme Court case of Griswold v. Connecticut. Then he answered: "The very idea is repulsive to the notions of privacy surrounding the marriage relationship." But the court did not long confine those "notions of privacy" to "the marriage relationship." In less than a decade it expanded the right of marital privacy into a right of reproductive privacy. In Eisenstadt v. Baird (1972) the court held that unmarried couples have the same right as married ones to obtain and use contraceptives, and the following year, in Roe v. Wade, the justices declared that the right to privacy includes abortion. In 1986 the justices refused to take the next step of recognizing a right to sexual privacy. In Bowers v. Hardwick, they upheld a state law prohibiting homosexual sodomy between consenting adults. But in 1992 the Supreme Court set the stage for overturning Bowers. In Planned Parenthood v. Casey--a decision for which Justices Sandra Day O'Connor, Anthony Kennedy and David Souter claimed joint authorship--the court essentially upheld Roe, while asserting a new, breathtakingly expansive formulation of the right to privacy. "Intimate and personal choices," the justices wrote, are "central to the liberty protected by the Fourteenth Amendment. At the heart of liberty is the right to define one's own concept of existence, of meaning, of the universe, and of the mystery of human life." Justice Kennedy cited this language in his majority opinion in Lawrence v. Texas, the 2003 case that found sodomy laws were unconstitutional after all. The U.S. Supreme Court has not yet taken up the question of same-sex marriage. But as Justice Antonin Scalia argued in his Lawrence dissent, it's hard to see how one could square a ban on same-sex marriage with what he mockingly called "the famed sweet-mystery-of-life passage." If the Constitution guarantees no less than the right to "define one's own concept of . . . the universe," how can government limit the definition of marriage to a man and a woman, or for that matter limit it at all? (Justice O'Connor argued in Lawrence that "preserving the traditional institution of marriage" is in fact a "legitimate state interest," but it's telling that none of the other five justices in the majority joined her concurrence.) None of these cases rest on solid legal ground. As Justice Douglas acknowledged in Griswold, the right to privacy is to be found not in the Constitution but in its "penumbras" and "emanations." At the same time, there is a strong political consensus against the government intruding into people's bedrooms. If Griswold and Lawrence disappeared from the books tomorrow, it's unlikely any state would rush to re-enact laws against contraceptives or consensual sodomy. Abortion and same-sex marriage, by contrast, do spark strong opposition, but not on privacy grounds. Abortion opponents argue that life before birth is worthy of legal protection, while the case against same-sex marriage is that it confers public approval on gay relationships--approval the New York and Massachusetts courts have given without public consent. When judges find rights in hidden constitutional meanings, they run a twofold risk. If they limit those rights, striking balances and compromises between such competing values as privacy vs. life or privacy vs. morality, they act as politicians, only without democratic accountability. The alternative, to let those rights expand without limit, seems more principled and thus is more appealing. But it ignores democracy's most important principle of all: the right of the people to govern themselves. Mr. Taranto is editor of OpinionJournal.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

As Piracy Battle Nears Supreme Court, the Messages Grow Manic
by R.A. Hettinga 07 Feb '05

07 Feb '05

<http://www.nytimes.com/2005/02/07/technology/07sharing.html?th=&pagewanted=…> The New York Times February 7, 2005 As Piracy Battle Nears Supreme Court, the Messages Grow Manic By TOM ZELLER Jr. Garret the Ferret is one hip copyright crusader. The cartoon character urges young cybercitizens toward ethical downloading and - in baggy jeans and a gold "G" medallion - reminds them that copying and sharing software is uncool. He is also a byproduct of the long-roiling public relations battle between copyright owners, who say they are threatened by digital piracy, and technology advocates opposed to strict controls on the copying of digital media, and on the kinds of software that make piracy so easy. With the Supreme Court scheduled next month to hear a pivotal case pitting copyright holders (represented by MGM Studios) against the makers of file-sharing software (Grokster and StreamCast Networks), some participants are putting their message machines into high gear. But winning hearts and minds - of teenagers, consumers and lawmakers - has never been a simple matter. "It's hard for two reasons," said Rick Weingarten, the director of the Office for Information Technology Policy at the American Library Association, which has been exploring ways to strike a balance in the copyright and antipiracy messages being aimed at young people. "Copyright law is not the easiest thing to explain, and it's hard to put a bumper sticker on it," Mr. Weingarten said. "But, you're also talking about the future, and it's hard to explain to a consumer that there could one day be a lot of restrictions on what you can do with new technology." One side must make people care about obscure technological innovations that they say will be stifled by legislative action or an adverse Supreme Court ruling. The other side battles the image of greedy corporate profiteers and the perception that freely downloading copyrighted works is something other than theft. "It was easier before the computer," said Dan Glickman, the president and chief executive of the Motion Picture Association of America, which has ramped up its antipiracy efforts in recent weeks with a new round of lawsuits and a media campaign warning would-be thieves to "think again." Two weeks ago, the association also began offering a free, downloadable program that allows parents to scan computers for file-sharing software and potentially pirated media files. "People knew they couldn't steal a video tape out of Blockbuster," Mr. Glickman said, "but the principles are still the same." Not to be outdone, the Electronic Frontier Foundation, the digital rights advocacy group that is representing StreamCast Networks in the Grokster case, unveiled its Endangered Gizmos campaign to coincide with the filing of dozens of MGM-friendly amicus briefs with the Supreme Court late last month. The campaign displays cheeky taxonomies of "extinct" or "endangered" techno-species like the original file-sharing service Napster, which was sued into submission, and the Streambox VCR, which allowed users to record streaming media off the Internet and suffered a similar fate. The foundation hopes to convince consumers and lawmakers that there are cultural costs to giving copyright holders too much power. "So many of the issues that we deal with are really abstruse," said Wendy Seltzer, an intellectual property attorney with the Electronic Frontier Foundation and the principal creator of the Endangered Gizmos campaign. "And yet they touch a whole segment of the public that we want to reach out to." Whether any of these messages is getting through is an open question. Survey data from the Pew Internet and American Life Project, a nonprofit research group in Washington, show that among those who actively download music, 58 percent still say they do not care if the material is copyright protected. Among the general public, 57 percent say they are unfamiliar with concepts like "fair use" - the kernel of copyright law that allows people to copy protected materials under certain conditions, and which digital rights groups contend has been inappropriately constricted by the recording and film industries. The fight has given rise to grass-roots organizations like Downhill Battle, a nonprofit group based in Worcester, Mass., that conducts a robust trade in T-shirts, bumper stickers, posters and other paraphernalia that chide the music and film industries for what it considers wanton profiteering at the expense of artists and consumers. In a challenge to fair-use restrictions, the group made digitized, downloadable copies of "Eyes on the Prize, Part I: Awakenings" - the first installment of a 1987 documentary on the civil rights movement - and is encouraging mass, noncommercial screenings of it tomorrow. The film has largely been absent from television and video rental shelves while the production company, Blackside Inc., of Boston, works to renew (and pay for) permissions on the hundreds of copyrighted elements used in the film - from archival news footage to songs like "Happy Birthday." Blackside was not pleased with the copying and distribution of its film, and persuaded the group to remove it from its Web site last week. But fear and confusion over the legal issues has led at least one county in Virginia to stop a teacher from showing the school's legally acquired copy of the film to students and community members. "The school district didn't understand that they have fair-use rights," said Tiffiniy Cheng, a director of Downhill Battle, which lists more than two dozen venues that, it says, have committed to screening the film. But the nagging fear of legal action, even among right-minded users of digital materials, has made it difficult for copyright holders to foster a positive public image - even though they see lawsuits as critical to stamping out theft. "It would be ideal if our educational efforts got more attention," said Mitch Bainwol, the chief executive of the Recording Industry Association of America, which has waged a well-publicized legal campaign against file sharers. "But the lawsuits get more coverage because of the nature of the controversy." Those on the digital rights side of the debate recognize the content industry's image problem - and they are not above exploiting it. But they know that their own image is troubled, too. Indeed, all but the most strident digital anarchists agree that illegal file sharing is wrong. Yet those who argue for strong fair-use protections are often portrayed by opponents as supporters of theft. "They can so easily be painted as favoring piracy," said Susan Crawford, a professor of Internet law at the Benjamin N. Cardozo Law School in New York and a member of the advisory board for Public Knowledge, a Washington group that has fought legislation that it argues would stifle new technological advances. "They have to deal with a concept that's even harder to visualize - innovation - and they have not found a sound bite or a picture that puts across a message to people." For groups like Public Knowledge, antipiracy tactics like the entertainment industry's case against Grokster and StreamCast or legislation like the Induce Act, which stalled in Congress last year and which opponents argued would have stifled technological innovation by making developers of file-sharing software subject to lawsuits, present a morass of legal and technical nuance that is hard to reduce to sound bites. That is why the Electronic Frontier Foundation has taken to turning the gizmos they see threatened by the Grokster lawsuit into pandas and spotted owls. "That's an image," Ms. Crawford said. "They can play on people's love for gadgets," although she added that it's not quite the humanizing stroke one might hope for. "It's an uphill battle to visualize innovation," she said. The Business Software Alliance, the powerful consortium of software manufacturers, might well agree with that sentiment. The group clearly wants to stamp out the use of pirated software - a recent study by International Data Corporation estimated that 36 percent of software installed on computers worldwide was pirated. But it is also interested in fostering the development of new technologies that, in addition to having perfectly legal uses, could also be abused by pirates. "It's easy for one side to say well, let's just limit the functionality of technology, because we only care about the pain it's causing our business," said Emery Simon, the director for general policy at the alliance. "On the flip side, you can say, well, technology is the superceding and overarching good. Both are right, and both are wrong." In addressing those rights and wrongs, the alliance has mounted some of the more ambitious public campaigns of any group - including the introduction of Garret the Ferret into schools. The group has also relicensed its use of the cartoon character Dilbert, which it has used to reach out to professional engineers, via Web sites like BSAengineers.com and through bulk mailings, to warn them against using pirated software. "We hope that the engineers that got the Dilbert flier will take the message home," said Debbi Mayster, the alliance's communications manager. It did not work for everyone. Bryan Fields, a partner and chief engineer with Illiana.net, an Internet service provider to customers in Illinois and Indiana, is one recipient who did not appreciate the gesture. He said in an e-mail message that he did not like seeing Dilbert, "who stands for everything that's wrong with soul-sucking corporations, acting as a mouthpiece for the most evil of them all - the B.S.A." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0