July 2005 - cypherpunks-legacy

[dave@farber.net: [IP] editorial comment -- more on middle-aged white females]
by Eugen Leitl 31 Jul '05

31 Jul '05

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

(no subject)
by Bryon Wiley 29 Jul '05

29 Jul '05

1 0

Interesting Article.
by Mari Burks 29 Jul '05

29 Jul '05

1 0

/. [RFID Tags To Track Foreigners, Identify Dead]
by Eugen Leitl 28 Jul '05

28 Jul '05

Link: http://slashdot.org/article.pl?sid=05/07/28/1456246 Posted by: Zonk, on 2005-07-28 15:46:00 from the many-purposes dept. An anonymous reader writes "U.S. security officials say they [1]will use RFID technology at border posts with Canada and Mexico to track foreigners driving in and out of the United States. A Department of Homeland Security spokesman said wireless chips for vehicles would become mandatory at designated border crossings in Canada and Mexico as of Aug. 4. At the same time, British officials are considering using [2]RFID chips to identify the dead in the wake of a disaster." From the British article: "...following the bomb blasts on the London Underground, the process of identifying some bodies - particularly on the deep-lying Piccadilly Line - became very difficult, with some families upset by the amount of time it took to confirm a relative had died. VeriChip advocates argue it could help in these circumstances. " References 1. http://informationweek.com/story/showArticle.jhtml?articleID=166403260 2. http://news.bbc.co.uk/1/hi/technology/4721175.stm ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Department of Homeland Security Surveillance Truck
by Eugen Leitl 28 Jul '05

28 Jul '05

http://eyeball-series.org/dhs-truck.htm -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Impact Equ-ity Report
by Caleb Ledford 28 Jul '05

28 Jul '05

WORLD STOCK REPORT ISSUED FOR JULY 28, 2005 EXPLOSIVE PICK FOR OUR MEMBERS -- !!!!!RIDE THE STAIRWAY TO HEAVEN!!!! Good day to all broker's, Day Trader's and Investor's World stock report has become famous with some great stock picks in the otc , small cap market's!!!!!!!!!! Here at World Stock Report we work on what we here from the street. Rumor's circulating and keeping the focus on the company's news. We pick our companies based on there growth potential. We focus on stocks that have great potential to move up in price.!!!!!!!!!! While giving you liquitity. OUR LATEST PICK IS CHMS. SYMBOL: CHMS CURRENT PRICE: $.47 SHORT TERM 7 DAY PROJECTION: $2.00 WE GIVE IT TO YOU AGAIN AS A GIFT AND THIS IS WHY. *****************PRESS RELEASE********************PRESS RELEASE********************** China Mobility Solutions Secures Extension on QuickNet Option Tuesday July, 12:13 pm ET VANCOUVER, British Columbia, July /PRNewswire-FirstCall/ -- China Mobility Solutions Inc. (OTC Bulletin Board: CHMS - News) is pleased to announce that the deadline for exercising its option to buy the remaining 49% of QuickNet Telecommunications Corp. (QuickNet) at a reduced rate has been extended to July 31, 2005 from June 26. The extension now gives the Company the opportunity to save $1 million in acquisition costs up until July 31, 2005. China Mobility Solutions initially acquired 51% of QuickNet in 2004 as a vehicle to rapidly expand its business in China. Based in Beijing, with nationwide mobile services, QuickNet was one of the first providers in China to focus on mobile solutions for business. It has a highly advanced technology platform and enterprise services that include advanced database management, CRM and message auditing functionality. About China Mobility Solutions Inc. China Mobility Solutions (OTC Bulletin Board: CHMS - News) is a leading provider of mobile business solutions to many diverse corporations across China. With its rapidly growing client base of more than 17,000 Chinese companies and access to a further 500,000 companies through its proprietary database, China Mobility Solutions is well positioned to become one of the largest providers of mobile business solutions in China. The Company has proprietary profit-sharing contracts with China's largest telecommunications companies -- China Mobile, China Unicom and China Telecom. Analysts predict that by 2007, China will have more than 500 million mobile phones in operation. In 2003, more than 200 billion text messages were sent through mobile phones in China. REMEMBER THIS IS A STONG BUY RECOMMENDATION TO ALL OUR INVESTORS DISCLAIMER Information within this email contains "for wardlooking stateme nts" within the meaning of Sec tion 27 Aof the Secur ities Act of 1933 and Section 21B of theSecu rities Exch ange Act of 1934. Any statem ents that express or invo lve discussions with respect to predi ctions, expect ations, beliefs, plans,proje ctions, object ives, goals, ass umptions or future events or performance are not state ments of histor ical fact and may be "forward looking statements."Forwa rdlooking state ments are based on expectat ions,estimates and proje ctions at the time the statements are made that involve a number of risks and uncer tainties which could cause actual results or events to differ materially from those presently ant icipated. Forward look ing stat ements in this action may be iden tified through the use of words such as"proje cts", "for esee", "exp ects", "will,""anti cipates," "esti mates," "belie ves," understan ds"or that by stat ements indicating certain actions"may," "could," or "might" occur. Risk factors include general econ omic and business con ditions, the ab ility to acqu ire and deve lop specific projects, the ability to fund operations and changes in consumer and busi ness consum ption habits and other factors overwhich the company has little or no control. The publisher of this newsl etter does not represent that the informa tion contained in this message states all material facts or does not omit a material fact necessary to make the statements therein not misleading. All infor mation provided within this email pert aining to inves ting, st ocks, securi ties must be under stood as information provi ded and not inves tment advice. The publi sher of this newsletter advises all readers and subscr ibers to seek advice from a reg istered profess ional secur ities repres ntative before deciding to trade in stocks featured within this email. None of the material within this report shall be construed as any kind of inves tment advice or soli citation. Many of these comp anies are on the verge of bank ruptcy. You can lose all your money by investing in this stock. We urge you to read the company's SEC filings now, before you invest. The publi sher of this newsletter is not a reg stered invstme nt advis or. Subscribers should not view information herein as legal, tax, accounting or invest ment advice. In comp liance with the Securiti esAct of 1933, Section 17(b),The publisher of this newsletter is contracted to receive two hundred fifty thousa nd free trad ing shares from a third party, not an officer,director or affi liate shar eholder for the circul ation of this report. Be aware of an inherent conflict of interest resulting from such compensa tion due to the fact that this is a paid adve rtisement and is not without bias.The party that paid us has a position in the st ock they will sell at anyt ime without notice.This could have a negat ive impact on the price of the st ock, causing you to lose money. All factual infor mation in this report was gat hered fr om public sources, including but not limited to SEC filings,Company Websites and Compa ny Press Rel eases. The publisher of this newsl etter beli eves this informationto be eliable but can make no guarantee as to its accuracy or comple teness. Use of the mat rial within this email consti tutes your accepta nce of these terms.

1 0

All your routers are belong to us
by Major Variola (ret) 28 Jul '05

28 Jul '05

Take da subway, its da bomb LAS VEGAS--Cisco Systems has taken legal action to keep a researcher from further discussing a hack into its router software. The networking giant and Internet Security Systems jointly filed a request Wednesday for a temporary restraining order against Michael Lynn and the organizers of the Black Hat security conference. The motion came after Lynn showed in a presentation how attackers could take over Cisco routers--a problem that he said could bring the Internet to its knees. The filing in U.S. District Court for the Northern District of California asks the court to prevent Lynn and Black Hat from "further disclosing proprietary information belonging to Cisco and ISS," said John Noh, a Cisco spokesman. "It is our belief that the information that Lynn presented at Black Hat this morning is information that was illegally obtained and violated our intellectual property rights," Noh added. Lynn decompiled Cisco's software for his research and by doing so violated the company's rights, Noh said. The legal moves came Wednesday afternoon, only hours after Lynn gave the talk at the Black Hat security conference here. Lynn told the audience that he had quit his job as a researcher at ISS to deliver the presentation, after ISS had decided to pull the session. Notes on the vulnerability and the talk, "The Holy Grail: Cisco IOS Shellcode and Remote Execution," were removed from the conference proceedings, leaving a gap in the thick book. Lynn outlined how to run attack code on Cisco's Internetwork Operating System by exploiting a known security flaw in IOS. The software runs on Cisco routers, which make up the infrastructure of the Internet. A widespread attack could badly hurt the Internet, he said. The actual flaw he exploited for his attack was reported to Cisco and has been fixed in recent releases of IOS, experts attending Black Hat said. The ISS research team, including Lynn, on Monday decided to cancel the presentation, Chris Rouland, chief technology officer at ISS, said in an interview. "It wasn't ready yet," he said. Lynn resigned from ISS on Wednesday morning and delivered the presentation anyway, Rouland added. Lynn presented ISS research while he was no longer an employee, Rouland said. Adding to the controversy, a source close to the Black Hat organization said that it wasn't ISS and Lynn who wanted to cancel the presentation, but Cisco. Lynn was asked to give a different talk, one on Voice over Internet Protocol security, the source said. But ISS' Rouland said there "was never a VoIP presentation" and that Wednesday's session was supposed to be cancelled altogether. "The research is very important, and the underlying work is important, but we need to work with Cisco to determine the full impact," Rouland said. Previous Next Cisco was involved in pulling the presentation, a source close to the company said. The networking giant had discussions with ISS and they mutually agreed that the research was not yet fully baked, the source said. The demonstration on Wednesday showed an attack on a directly connected router, not a remote attack over the Internet. "You could bring down your own router, but not a remote one," Rouland said. One Black Hat attendee said he was impressed with Lynn's presentation. "He got a shell really easy and showed a basic outline how to do it. A lot of folks have said this could not be done, and he sat up there and did it," said Darryl Taylor, a security researcher. "Shell" is a command prompt that gives control over the operating system. Noh said that Lynn's presentation did not disclose information about a new security vulnerability or new security flaws. "His research explored possible ways to expand the exploitation of existing vulnerabilities affecting routers," the Cisco spokesman said. Cisco has patched several flaws in IOS over the past year. Last year, the San Jose, Calif., networking giant said that part of the IOS source code had been stolen, raising fears of more security bugs being found. On Wednesday, Noh reiterated the company's usual advice that customers upgrade their software to the latest versions to mitigate vulnerabilities. Following his presentation, Lynn displayed his resume to the audience and announced he was looking for a job. Lynn was not available for comment. Representatives of the Black Hat organization said the researcher was meeting with lawyers.

1 0

[jrandom@i2p.net: [i2p] 0.6 is available]
by Eugen Leitl 27 Jul '05

27 Jul '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Privacy Guru Locks Down VOIP
by Eugen Leitl 27 Jul '05

27 Jul '05

http://wired.com/news/print/0,1294,68306,00.html Privacy Guru Locks Down VOIP By Kim Zetter Story location: http://www.wired.com/news/technology/0,1282,68306,00.html 10:20 AM Jul. 26, 2005 PT First there was PGP e-mail. Then there was PGPfone for modems. Now Phil Zimmermann, creator of the wildly popular Pretty Good Privacy e-mail encryption program, is debuting his new project, which he hopes will do for internet phone calls what PGP did for e-mail. Zimmermann has developed a prototype program for encrypting voice over internet protocol, or VOIP, which he will announce at the BlackHat security conference in Las Vegas this week. Like PGP and PGPfone, which he created as human rights tools for people around the world to communicate without fear of government eavesdropping, Zimmermann hopes his new program will restore some of the civil liberties that have been lost in recent years and help businesses shield themselves against corporate espionage. VOIP, or internet telephony, allows people to speak to each other through their computers using a microphone or phone. But because VOIP uses broadband networks to transmit calls, conversations are vulnerable to eavesdropping in the same way that e-mail and other internet traffic is open to snoops. Attackers can also hijack calls and reroute them to a different number. Few people consider these risks, however, when they switch to VOIP. "Years ago, people kind of stumbled into e-mail without really thinking about security," Zimmermann said. "I think that what's happening today with VOIP is that we're kind of stumbling into it (as well) without thinking about security." People don't think about it, he said, because they're used to phone calls being secure on the regular phone system -- known as the Public Switched Telephone Network. "The PSTN is like a well-manicured neighborhood, (while) the internet is like a crime-ridden slum," Zimmermann said. "To move all of our phone calls from the PSTN to the internet seems foolish without protecting it." Interest in VOIP is growing rapidly because the user pays less for the service and pays no long-distance toll charges. Some services are free. According to one recent survey, 11 million people worldwide use a subscription VOIP service, compared to only 5 million in 2004, and at least another 35 million use free VOIP services. That leaves a lot of people potentially open to eavesdropping. It's not as easy to eavesdrop on VOIP as it is to intercept and read e-mail. Phone conversations aren't stored or backed up where an attacker can access them, so the conversations have to be captured as they occur. But a program available for free on the internet already allows intruders to do just that. Using the tool, someone with access to a local VOIP network could capture traffic, convert it to an audio file and replay the voice conversation. The program is called Voice Over Misconfigured Internet Telephones, a name clearly chosen for its catchy acronym -- VOMIT. Bruce Schneier, chief technology officer of Counterpane Internet Security and author of the Crypto-Gram newsletter, said that the need for VOIP encryption is a given. "If you're concerned about eavesdropping, then encryption is how you defend against it," he said. "And it's not that hard to do. It's just a matter of writing the code." But David Endler, chairman of the VOIP Security Alliance industry group and director of security research at TippingPoint, said a protocol for encrypting and protecting VOIP data already exists and companies are starting to make VOIP phones that support the protocol. But he said that people typically don't enable the encryption option. "Probably because we're not seeing attacks yet," he said. He said most users are less concerned with eavesdropping than with having VOIP service that provides the same quality and reliability that they expect from regular phone service. "Some people can see clearly that there's a need for this, and others wonder if anyone cares about protecting phone calls," Zimmermann said. "But those are the same people who wondered why anyone would want to protect e-mail. I think as people gain experience with VOIP they're going to have a great appreciation for the need to come up with extra measures to protect it." Endler also said that companies using VOIP are reluctant to implement encryption because of the overhead involved in managing the public key infrastructure, or PKI. "You have to be able to store a key on most of these end points," he said. PKI requires two keys for encryption: a public key that a user gives to anyone who wishes to communicate with him or her, and a private key, which decrypts messages that the user receives. That won't be a problem with Zimmermann's system, which doesn't use PKI. Zimmermann said PKI is unnecessarily complex for VOIP. "There's no need to centrally manage public key infrastructure to make a phone call, in my view," he said. He won't elaborate on how his system works but is preparing a protocol document that will describe it in detail, which he'll post on the internet when the program is ready. The program is currently only a working prototype and still has non-security bugs that need to be worked out. For example, sometimes the program fails to hang up after a call, forcing the user to exit the program to end the call. It's designed for a Mac, but will be adapted for PCs before Zimmermann makes it available for download. He's looking for investors to back a startup company that will support the product and oversee its distribution. Zimmermann envisions it both as an add-on for manufacturers to put into VOIP phones and as a software client that users can install on their laptop to use when they don't have a VOIP phone with them. Both parties in a conversation will need to have the software on their phone or computer. If only one person has it, the call will still go through but it won't be encrypted. It's been a while since Zimmermann came out with a new encryption product. He released PGP in 1991; it was another five years before he released PGPfone to encrypt data passing between modems. Who could blame him for laying low for a while after the Justice Department launched a three-year criminal investigation of him in 1993? Officials accused him of violating a ban on exporting cryptography when he made PGP available for download on the internet. The government finally dropped its investigation in 1996. The export laws were relaxed in 2000, so at least they're no longer a problem. "There's a lot more crypto in the computer industry now than there was in the '90s," Zimmermann said. "And there's not much authorities can do about it now because we went through this struggle with them in the '90s and we won." Zimmermann isn't taking chances, however. He worked closely with a law firm that specializes in export controls and filed the required paperwork with the Commerce Department notifying the government that his product exists. Still, he delayed producing VOIP encryption after the Sept. 11 terrorist attacks, because the climate wasn't right. "I was concerned that maybe this would attract some criticism," Zimmermann said. "I just felt that maybe the government had their hands full with enough problems, and I also needed to concentrate on other consulting projects to make money." Zimmermann received hate mail after 9/11 from people who accused him of aiding the attackers by creating a program that allowed terrorists and criminals to shield their correspondence from authorities. The Washington Post erroneously reported shortly after the attacks that Zimmermann was overwhelmed with guilt over the possibility that terrorists might have used PGP to plan their attacks. What he actually said was that he was sorry if al-Qaida used the program, but that this was the trade-off for having a tool that could protect everyone's privacy -- some people would use it with malicious intent. Overall, he said, the world was better off with cryptography in the hands of the masses rather than just in the hands of government. Zimmermann is hoping people will accept his new program with the spirit in which he created it. "Because there are a lot of people who are concerned about the erosion of civil liberties that the Patriot Act brought," Zimmermann said. "I'm hoping that more people would approve of this project than disapprove." Ultimately, however, he said that his encryption program was not about politics, but about the need for protecting critical infrastructure. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

2 1

go for the head shot -they're wearing puffy jackets
by Major Variola (ret) 27 Jul '05

27 Jul '05

Now that the UK got a little feedback for their empire assist, its amusing (in a black, american kinda way) to see them demonstrate their lack of a first amendment. The papers are filled with brits calling for state coercion against their own citizens for their opinions. Naturally, the sheeple will trade liberty for pseudo-security. Which is cooler? A somali surrounded by men with guns, which he figures are mugging him, and who gets shot when he tries to give them his wallet; or a brazilian who gets shot when he thinks he's being mugged by similar anglos with guns? The somali got a few dozen holes, the brazilian less than a dozen, I guess that's the british reluctance to use guns :-) As G Gordon Liddy said, go for the head shot. They're wearing body armor. Or a special vest. Or just a puffy jacket. Whatever. Who knew Orwell was *such* an optimist? Or that the Bill of Rights made such excellent toilet paper? BTW, how do you say "enriched" in Korean?

1 0